Password disclosure in log file in Nextcloud Mail App

Vulnerability

Nextcloud Mail versions prior to 1.12.1 log user passwords in plaintext to nextcloud.log when the initial account setup fails (e.g., wrong IMAP port). The password is included in the log message when a CouldNotConnectException is caught [1][2]. This occurs regardless of log level, and the log file may be accessible to local users or forwarded to external logging systems.

Exploitation

An attacker with read access to the Nextcloud log file (e.g., via local file inclusion, compromised admin account, or shared hosting) can extract plaintext passwords. The vulnerability is triggered when a user provides incorrect IMAP/SMTP settings during account creation, causing the error to be logged with the password [1]. No authentication is needed beyond log access.

Impact

Successful exploitation yields the victim's email account password. If the same password is reused for the Nextcloud account, full account compromise is possible [3]. The attacker gains the ability to read, send, and delete emails, and potentially pivot to other services.

Mitigation

Upgrade to Nextcloud Mail version 1.12.1, which removes the password from log messages [2][3]. Operators should inspect existing logs and remove any logged passwords. No workaround exists to prevent logging during misconfiguration; only correct setup avoids the error [3].