CVE-2026-107059 in Nextcloud
Summary
by MITRE • 10/29/2026
An issue in Nextcloud versionCode 30390190 allows attackers to force victim users to logout of their accounts and switch to an attacker controlled progile, bypassing authentication.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/29/2026
The vulnerability identified in Nextcloud client versions prior to the fix for codebase identifier 30390190 represents a critical security flaw centered on session management and identity integrity. This issue allows malicious actors to manipulate the local state of an authenticated user's device, effectively hijacking their active sessions without requiring valid credentials or exploiting cryptographic weaknesses in the server-side authentication protocol. The core technical failure lies in how the client application handles profile switching logic when interacting with Nextcloud servers that support multiple accounts or profiles within a single installation. By leveraging specific API endpoints or manipulating local configuration files and session tokens, an attacker can force the client to discard the current user's active credentials and load a pre-configured account controlled by the adversary. This bypasses standard authentication mechanisms because the application trusts the integrity of its own internal state management rather than re-validating the identity with the server during profile transitions in certain contexts.
From a technical perspective, this flaw is classified under CWE-287, which covers Improper Authentication, and more specifically relates to CWE-613, Insufficient Session Expiration, as it involves the improper handling of session tokens during state changes. The attack vector typically requires physical access to an unlocked device or prior compromise of a user's local environment where malicious configuration files can be injected or modified. Once executed, the vulnerability allows the attacker to seamlessly switch the client interface to display data from their own Nextcloud account while maintaining the appearance that the legitimate user is still logged in. This creates a sophisticated social engineering opportunity where the victim may continue interacting with what they believe is their personal cloud storage environment, unaware that sensitive files are being exfiltrated or manipulated by the attacker through the hijacked profile context.
The operational impact of this vulnerability extends beyond simple unauthorized access to include significant risks related to data integrity and confidentiality. An attacker who successfully exploits this flaw can read private documents stored in Nextcloud folders associated with the victim's account, upload malicious files that appear to originate from the legitimate user, or delete critical data causing denial of service for business operations. Furthermore, because the attack manipulates local client state rather than server-side authentication directly, it may evade traditional network-based intrusion detection systems and audit logs that focus on login events at the application layer. The persistence of this access depends on how long the manipulated profile remains active in the client configuration before a full re-authentication cycle is triggered by normal user activity or scheduled sync operations.
Mitigation strategies must address both immediate remediation and longer-term architectural improvements. Users should immediately update their Nextcloud clients to versions that include patches for issue 30390190, ensuring that vendor-provided fixes for session handling logic are applied. Administrators should enforce strict device management policies using Mobile Device Management (MDM) solutions to prevent unauthorized modification of application configuration files on corporate devices. Additionally, implementing multi-factor authentication at the client level can add a layer of verification during profile switches or sensitive operations, reducing the effectiveness of state manipulation attacks. Security teams should also monitor for anomalous patterns in file access logs that might indicate data exfiltration through hijacked sessions and consider enabling enhanced audit logging to detect unauthorized configuration changes on endpoints running vulnerable clients.