Passcode bypass on Talk Android app

Description

Impact

To exploit this the attacker needs to have a physical access to the target’s device.
Due to the bypass of passcode an attacker is able to access the user’s Nextcloud files and view conversations.

Patches

It is recommended that the Nextcloud Talk Android app is upgraded to 15.0.2

Workarounds

No workaround available

References

• HackerOne
• PullRequest

For more information

If you have any questions or comments about this advisory:

• Create a post in nextcloud/security-advisories
• Customers: Open a support ticket at support.nextcloud.com