Is CVE-2026-107059 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-107059 being exploited in the wild.

How severe is CVE-2026-107059?

Informational severity, published 29 October 2026.

Is there a fix for CVE-2026-107059?

No fixed version is recorded yet. Add an android:permission requirement or set android:exported="false" on the AuthenticatorActivity component to restrict external access to vendor applications only. [{"kind":"disclosed","at":"2026-10-11"},{"kind":"other","at":"2026-10-29","note":"CVE-2026-107059 assigned"}] If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-107059 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-107059?

Check whether you run Nextcloud Android at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-107059: Nextcloud Android authentication bypass via exported activity

CVE-2026-107059 · Severity: info · Published 2026-10-29

The Nextcloud Android app contains an exported activity that accepts login credentials from any app without requiring permissions or user confirmation. An attacker app can silently create a malicious account on the victim's device and set it as the active account, allowing the attacker to access the victim's Nextcloud data through that account if they control the server endpoint.

Vendors: Nextcloud.

Quick answers

Is CVE-2026-107059 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-107059 being exploited in the wild.
How severe is CVE-2026-107059?: Informational severity, published 29 October 2026.
Which products and versions are affected?: Nextcloud Android 30390190.
Is there a fix for CVE-2026-107059?: No fixed version is recorded yet. Add an android:permission requirement or set android:exported="false" on the AuthenticatorActivity component to restrict external access to vendor applications only.</anigation> <parameter name="timeline">[{"kind":"disclosed","at":"2026-10-11"},{"kind":"other","at":"2026-10-29","note":"CVE-2026-107059 assigned"}] If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-107059 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-107059?: Check whether you run Nextcloud Android at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Add an android:permission requirement or set android:exported="false" on the AuthenticatorActivity component to restrict external access to vendor applications only.</anigation> <parameter name="timeline">[{"kind":"disclosed","at":"2026-10-11"},{"kind":"other","at":"2026-10-29","note":"CVE-2026-107059 assigned"}]

Technical details

The AuthenticatorActivity component is exported without permission checks and accepts nc://login deep links containing server, username, and password parameters. The vulnerability exists in two ungated code paths (onServiceConnected on cold start and inherited onNewIntent on subsequent delivery) that call addAccountExplicitly and setCurrentOwnCloudAccount without user confirmation, unlike the gated QR code login branch in the same class. An attacker app on the same device with no runtime permissions can exploit this by launching the activity with a crafted URI pointing to an attacker-controlled server.

Affected products

Nextcloud Nextcloud Android 30390190

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.