CVE-2023-22472

8.8 highEPSS 0.2%

High (8.8) in nextcloud desktop. EPSS 0.2% chance of exploitation in the next 30 days.

Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. It is possible to make a user send any POST request with an arbitrary body given they click on a malicious deep link on a Windows computer. (e.g. in an email, chat link, etc). There are currently no known workarounds. It is recommended that the Nextcloud Desktop client is upgraded to 3.6.2.

Severity

CVSS 3.1

8.8 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS: 0.2% chance of exploitation in the next 30 days; higher than 11% of CVEs (scores of 2026-10-31)
CWE: CWE-352
Published: 2023-01-09
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

nextcloud:desktop

References

https://github.com/nextcloud/desktop/pull/5106
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-4gfv-xqpx-42qj
https://github.com/nextcloud/desktop/pull/5106
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-4gfv-xqpx-42qj

Check your stack JSON