Executive brief
A security flaw in the Nextcloud Android application allows an unauthorized person with physical access to a device to bypass the app's PIN protection. By using the device's back button after the phone itself is unlocked, an attacker could gain access to private files stored within the Nextcloud app. This compromises the confidentiality of user data even when the application-level security lock is enabled.
Technical details
An improper authentication vulnerability (CWE-287) exists in the Nextcloud Android Files app's PassCodeActivity. In affected versions (33.0.0 to 33.1.0), the application fails to correctly enforce the PIN lock state when navigating via the system back button immediately after the Android device itself is unlocked. An attacker with physical access to the device and low-level privileges (knowledge of the device lock but not the app PIN) can bypass the secondary security layer to access, and potentially modify, files. The issue is resolved in version 33.1.0 by refactoring the passcode activity handling.
Affected products
- Nextcloud Nextcloud Files (Android) 33.0.0 to 33.1.0
Timeline
- 2026-04-22: patched: Fix merged into master and backported to stable-33.1.0 branch.
- 2026-05-12: advisory: GitHub Security Advisory GHSA-2w7v-5299-3hw5 published.
- 2026-06-01: disclosed: CVE-2026-45153 published to NVD.