How severe is CVE-2023-25820?

CVE-2023-25820 has a CVSS 3.x base score of 4.2, rated medium severity. It is exploitable over local access with high attack complexity, requires low privileges and user interaction. Impact on confidentiality is low, integrity low, and availability low.

Is CVE-2023-25820 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (14th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2023-25820?

CVE-2023-25820 primarily affects Nextcloud Nextcloud Server. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2023-25820?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2023-25820 published?

CVE-2023-25820 was published on 2023-03-22 and last updated on 2026-06-17.

CVE-2023-25820

CVE-2023-25820 is a medium-severity vulnerability in Nextcloud Nextcloud Server with a CVSS 3.x base score of 4.2. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-307.

Key facts

Severity: Medium (CVSS 3.x base score 4.2)
EPSS exploit prediction: 0% (14th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-307
Affected product: Nextcloud Nextcloud Server
Published: 2023-03-22
Last modified: 2026-06-17

Description

Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform, and Nextcloud Enterprise Server is the enterprise version of the file server software. In Nextcloud Server versions 25.0.x prior to 25.0.5 and versions 24.0.x prior to 24.0.10 as well as Nextcloud Enterprise Server versions 25.0.x prior to 25.0.4, 24.0.x prior to 24.0.10, 23.0.x prior to 23.0.12.5, 22.x prior to 22.2.0.10, and 21.x prior to 21.0.9.10, when an attacker gets access to an already logged in user session they can then brute force the password on the confirmation endpoint. Nextcloud Server should upgraded to 24.0.10 or 25.0.4 and Nextcloud Enterprise Server should upgraded to 21.0.9.10, 22.2.10.10, 23.0.12.5, 24.0.10, or 25.0.4 to receive a patch. No known workarounds are available.

Frequently asked questions

What is CVE-2023-25820?: Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform, and Nextcloud Enterprise Server is the enterprise version of the file server software. In Nextcloud Server versions 25.0.x prior to 25.0.5 and versions 24.0.x prior to 24.0.10 as well as Nextcloud Enterprise Server versions 25.0.x prior to 25.0.4, 24.0.x prior to 24.0.10, 23.0.x prior to 23.0.12.5, 22.x prior to 22.2.0.10, and 21.x prior to 21.0.9.10, when an attacker gets access to an already logged in user session they can then brute force the password on the confirmation endpoint. Nextcloud Server should upgraded to 24.0.10 or 25.0.4 and Nextcloud Enterprise Server should upgraded to 21.0.9.10, 22.2.10.10, 23.0.12.5, 24.0.10, or 25.0.4 to receive a patch. No known workarounds are available.
How severe is CVE-2023-25820?: CVE-2023-25820 has a CVSS 3.x base score of 4.2, rated medium severity. It is exploitable over local access with high attack complexity, requires low privileges and user interaction. Impact on confidentiality is low, integrity low, and availability low.
Is CVE-2023-25820 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (14th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2023-25820?: CVE-2023-25820 primarily affects Nextcloud Nextcloud Server. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2023-25820?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2023-25820 published?: CVE-2023-25820 was published on 2023-03-22 and last updated on 2026-06-17.

References

Affected products (2)

cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:enterprise:*:*:*
cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:*:*:*:*

More vulnerabilities in Nextcloud Nextcloud Server

CVE-2021-22915 — Critical (CVSS 9.8): Nextcloud server before 19.0.11, 20.0.10, 21.0.2 is vulnerable to brute force attacks due to lack of inclusion of IPv6…
CVE-2021-32802 — Critical (CVSS 9.3): Nextcloud server is an open source, self hosted personal cloud. Nextcloud supports rendering image previews for user…
CVE-2023-26482 — Critical (CVSS 9.0): Nextcloud server is an open source home cloud implementation. In affected versions a missing scope validation allowed…
CVE-2021-32688 — High (CVSS 8.8): Nextcloud Server is a Nextcloud package that handles data storage. Nextcloud Server supports application specific…
CVE-2018-3775 — High (CVSS 8.8): Improper Authentication in Nextcloud Server prior to version 12.0.3 would allow an attacker that obtained user…
CVE-2023-35172 — High (CVSS 8.7): NextCloud Server and NextCloud Enterprise Server provide file storage for Nextcloud, a self-hosted productivity…

All CVEs affecting Nextcloud Nextcloud Server →

Other CWE-307 (Improper Restriction of Excessive Authentication Attempts) vulnerabilities

CVE-2026-6853 — Critical (CVSS 9.8): Improper restriction of excessive authentication attempts vulnerability in Başbelen Group Food Cafe Businesses…
CVE-2026-8760 — Critical (CVSS 9.8): The Login with OTP plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including,…
CVE-2020-37228 — Critical (CVSS 9.8): iDS6 DSSPro Digital Signage System 6.2 contains a CAPTCHA security bypass vulnerability that allows attackers to bypass…
CVE-2026-33879 — Critical (CVSS 9.8): Federated Learning and Interoperability Platform (FLIP) is an open-source platform for federated training and…
CVE-2026-33640 — Critical (CVSS 9.8): Outline is a service that allows for collaborative documentation. Outline implements an Email OTP login flow for users…
CVE-2026-31851 — Critical (CVSS 9.8): Nexxt Solutions Nebula 300+ firmware through version 12.01.01.37 does not implement rate limiting or account lockout…

Browse all CWE-307 (Improper Restriction of Excessive Authentication Attempts) vulnerabilities →