Sensitive files/data exist after deletion of user account in Nextcloud Android

Vulnerability

Sensitive tokens, images, and user-related details persist after deletion of a user account in Nextcloud Android versions prior to 3.19.0. This occurs because the AccountRemovalWork cleanup process does not adequately remove all stored data. [1]

Exploitation

An attacker who gains access to the device or its storage (e.g., via physical access, backup extraction, or remote compromise) can retrieve the residual data. No additional privileges or user interaction are required beyond obtaining access to the stored data. [1]

Impact

Successful exploitation results in unauthorized disclosure of sensitive information, including authentication tokens, profile images, and other user-related details of the former account holder. This compromises confidentiality and could lead to further misuse of the affected user's identity or services. [1]

Mitigation

The issue is fixed in Nextcloud Android version 3.19.0, released on 2022-05-20, which properly cleans up user data upon account deletion. No workarounds are available for earlier versions. Users should update to the latest version. [1][2]