CVE-2022-24886

—

CVSS 3.1

3.8 low

EPSS

<1%p32

Published

Apr 27, 2022 (Apr 27, 2022)

Modified

Jun 17, 2026

Description

Nextcloud Android app is the Android client for Nextcloud, a self-hosted productivity platform. In versions prior to 3.19.0, any application with notification permission can access contacts if Nextcloud has access to Contacts without applying for the Contacts permission itself. Version 3.19.0 contains a fix for this issue. There are currently no known workarounds.

Vendors: nextcloud
Products: nextcloud
Weakness: CWE-200, CWE-732
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (0.4%)

In the news0 stories

No ingested article mentions this CVE yet.