Low severity2.2NVD Advisory· Published Apr 27, 2022· Updated Jun 17, 2026

CVE-2022-24886

Description

Nextcloud Android app is the Android client for Nextcloud, a self-hosted productivity platform. In versions prior to 3.19.0, any application with notification permission can access contacts if Nextcloud has access to Contacts without applying for the Contacts permission itself. Version 3.19.0 contains a fix for this issue. There are currently no known workarounds.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Nextcloud/Android Appllm-fuzzy
Range: <3.19.0
osv-coords
pkg:bitnami/nextcloud
Range: < 3.19.0
nextcloud/security-advisoriesv5
Range: < 3.19.0

Patches

Vulnerability mechanics

References

github.com/nextcloud/android/pull/9726nvdThird Party Advisory
github.com/nextcloud/security-advisories/security/advisories/GHSA-5cj3-v98r-2wmqnvdThird Party Advisory
hackerone.com/reports/1161401nvdPermissions RequiredThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.143
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000