PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45153 nextcloud CVE debrief

A medium-severity authentication bypass vulnerability in the Nextcloud Files Android application allows a local attacker with physical device access to circumvent the application PIN protection. The flaw exists in versions 33.0.0 through 33.0.x, where unlocking a locked Android device and subsequently using the system back-button enables navigation past the application's PIN screen without valid authentication. The CVSS 3.1 vector (AV:P/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N) reflects the physical access requirement, high attack complexity, low privileges, and resulting high confidentiality impact with low integrity impact. The vulnerability stems from improper authentication state management (CWE-287) when handling Android lifecycle events after device unlock. Nextcloud patched this issue in version 33.1.0.

Vendor
nextcloud
Product
security-advisories
CVSS
MEDIUM 4.6
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-01
Original CVE updated
2026-07-22
Advisory published
2026-06-01
Advisory updated
2026-07-22

Who should care

Organizations using Nextcloud Files for Android with PIN protection enabled; mobile security administrators; users storing sensitive data in Nextcloud on Android devices; security teams evaluating mobile application authentication controls.

Technical summary

The Nextcloud Files Android application (versions 33.0.0 to 33.0.x) fails to properly maintain authentication state when the Android device transitions from locked to unlocked. After a user unlocks their Android device, pressing the system back-button allows navigation backward through the activity stack, bypassing the application's PIN protection screen. This represents an authentication bypass (CWE-287) where the application does not revalidate the PIN requirement upon resumption after device unlock. The attack requires physical possession of the device and knowledge of the device unlock method, but not the Nextcloud app PIN. The fix in version 33.1.0 likely adds proper lifecycle handling to clear activity history or re-prompt for PIN authentication when the device is unlocked.

Defensive priority

medium

Recommended defensive actions

  • Upgrade Nextcloud Files Android app to version 33.1.0 or later
  • Enable full-device encryption and strong screen lock to reduce physical access attack surface
  • Review and test application authentication flows after device lock/unlock cycles during security assessments
  • Monitor for unauthorized file access in Nextcloud audit logs on devices running affected versions
  • Apply mobile device management policies that enforce minimum app versions for corporate Nextcloud deployments

Evidence notes

CVE published and modified 2026-06-01. NVD status: Deferred. Vendor attribution based on reference domain candidate (HackerOne) with low confidence; product identified as Nextcloud Files Android app from advisory content.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-45153 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-45153

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-45153 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-45153

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.