CVE-2026-45153

EUVD-2026-33672
Nextcloud is an open source content collaboration platform. From version 33.0.0 to before version 33.1.0, after unlocking a locked Android phone the back-button could be used to bypass the Nextcloud Files app PIN. This issue has been patched in version 33.1.0.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
4.6 MEDIUM
PHYSICAL
HIGH
LOW
CVSS:3.1/AV:P/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Common Weakness Enumeration
References
https://github.com/nextcloud/android/pull/16896
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-2w7v-5299-3hw5
https://hackerone.com/reports/3625210