CVE-2023-25160 IDOR Vulnerability in Nextcloud Mail

Medium 4.1 Published 13 Feb 2023 Updated 10 Mar 2025

An attacker can access other users' mailboxes by ID to read email subjects and content, requiring an upgrade to the Nextcloud Mail app.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2023-25160?

CVE-2023-25160 is a medium-severity missing authorization vulnerability in nextcloud security-advisories, published on 13 Feb 2023. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

Nextcloud Mail is an email app for the Nextcloud home server platform. Prior to versions 2.2.1, 1.14.5, 1.12.9, and 1.11.8, an attacker can access the mail box by ID getting the subjects and the first characters of the emails. Users should upgrade to Mail 2.2.1 for Nextcloud 25, Mail 1.14.5 for Nextcloud 22-24, Mail 1.12.9 for Nextcloud 21, or Mail 1.11.8 for Nextcloud 20 to receive a patch. No known workarounds are available.

Weakness: CWE-639

Which versions are affected by CVE-2023-25160?

It affects 1 product.

Products include Nextcloud Mail.

How do I fix CVE-2023-25160?

No fix has been published for CVE-2023-25160 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2023-25160 being exploited?

There is no known exploitation of CVE-2023-25160 in the wild and no public exploit code.

Sources

Also known as GHSA-m45f-r5gh-h6cx.