CVSS 3.1 Score 5.4 of 10 (medium)


Published Dec 22, 2023
Updated: Jan 3, 2024
CWE ID 287
CWE ID 284


CVE-2023-49791 is a vulnerability affecting Nextcloud Server, an open-source cloud platform. The vulnerability exists in versions prior to 26.0.9 and 27.1.4 of Nextcloud Server, as well as versions prior to,,, 26.0.9, and 27.1.4 of Nextcloud Enterprise Server. If an attacker gains access to an active session of another user through unauthorized means, they can bypass the password confirmation and delete or modify workflows by sending direct calls to the API, without being detected through the user interface (UI). The issue has been patched in Nextcloud Server versions 26.0.9 and 27.1.4 and Nextcloud Enterprise Server versions,, 25.

Organizations using affected versions of Nextcloud should update to the patched versions mentioned above to remediate the vulnerability and protect against potential exploitation by attackers with unauthorized access to user sessions.

This vulnerability poses a medium risk with a base severity rating of 5.

4 out of a possible score of 10 according to the Common Vulnerability Scoring System (CVSS) version 3.

Explore Beyond the CVE Basics with Recorded Future's Vulnerability Intelligence

Note: This is just a basic overview providing quick insights into CVE-2023-49791 information. Gain full access to comprehensive CVE data, risk scores, prioritization, and mitigation data through Recorded Future's Vulnerability Intelligence:
  • Prioritize with Risk-Based Scoring
  • Explore the Extensive Vulnerability Database
  • Receive Early Alerts on Emerging CVEs
  • Focus on Critical Exploitable Vulnerabilities
  • Streamline Remediation with Integration Options