Missing password confirmation when creating app passwords

Description

Impact

A missing password confirmation allowed an attacker, after successfully stealing a session from a logged in user, to create app passwords for the victim.

Patches

It is recommended that the Nextcloud Server is upgraded to 25.0.9, 26.0.4 or 27.0.1
It is recommended that the Nextcloud Enterprise Server is upgraded to 20.0.14.15, 21.0.9.13, 22.2.10.14, 23.0.12.9, 24.0.12.5, 25.0.9, 26.0.4 or 27.0.1

Workarounds

• No workaround available

References

• HackerOne
• PullRequest

For more information

If you have any questions or comments about this advisory:

• Create a post in nextcloud/security-advisories
• Customers: Open a support ticket at portal.nextcloud.com