Ownership check missing when updating or deleting mail attachments in Nextcloud mail

Vulnerability

Nextcloud Mail versions before 1.12.2 fail to verify that the user performing operations on mail attachments (such as updating or deleting) owns the attachment. The missing check allows an authenticated user to manipulate attachments belonging to other users. This affects the LocalAttachment handling in the mail app [1][2][3].

Exploitation

An attacker with a valid Nextcloud account can send crafted requests to update or delete mail attachments they do not own, by exploiting the missing ownership verification in the mail app's attachment endpoints. No special privileges beyond a regular account are required [3].

Impact

Successful exploitation allows an attacker to overwrite the local_message_id for draft attachments or delete them, making the attachment unavailable to the legitimate sender. However, the attacker cannot read or exfiltrate the attachment content; only availability is impacted [3].

Mitigation

Upgrade Nextcloud Mail to version 1.12.2 or later, which includes the fix. No workarounds are available [3]. The fix was merged via pull request #6600 [1][2]. This CVE is not listed on CISA's KEV as of publication.