CVE-2022-39329 Profile of disabled user stays accessible

Low 3.5 Published 27 Oct 2022 Updated 23 Apr 2025

Attackers can access profiles of disabled users, exposing information that administrators cannot control without direct database access.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2022-39329?

CVE-2022-39329 is a low-severity missing authorization vulnerability in Nextcloud Nextcloud Server, published on 27 Oct 2022. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Nextcloud Server and Nextcloud Enterprise Server prior to versions 23.0.9 and 24.0.5 are vulnerable to exposure of information that cannot be controlled by administrators without direct database access. Versions 23.0.9 and 24.0.5 contains patches for this issue. No known workarounds are available.

Weakness: CWE-862, CWE-285, CWE-284

Which versions are affected by CVE-2022-39329?

It affects 2 products.

Products include Nextcloud Nextcloud Enterprise Server, Nextcloud Nextcloud Server.

How do I fix CVE-2022-39329?

No fix has been published for CVE-2022-39329 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2022-39329 being exploited?

There is no known exploitation of CVE-2022-39329 in the wild and no public exploit code.

All Nextcloud Nextcloud Server vulnerabilities

Sources

Also known as GHSA-8f3p-rcm5-mrg3.