IDOR Vulnerability in Nextcloud Mail

Vulnerability

Nextcloud Mail, an email app for Nextcloud, contains an Insecure Direct Object Reference (IDOR) vulnerability in the mailbox cache sync functionality. An attacker can access a mailbox by its ID and retrieve the subjects and first characters of emails. Affected versions are all releases before Mail 2.2.1 (Nextcloud 25), 1.14.5 (Nextcloud 22-24), 1.12.9 (Nextcloud 21), and 1.11.8 (Nextcloud 20) [1][2].

Exploitation

An attacker needs network access to the Nextcloud instance and must be able to send API requests. No special authentication is required beyond a valid user session; the vulnerability allows a user to enumerate mailbox IDs belonging to other users. The attacker can craft requests to the mailbox cache endpoint with arbitrary mailbox IDs to retrieve subject lines and the first characters of email bodies [2].

Impact

Successful exploitation results in unauthorized disclosure of email subjects and partial content (first characters) of emails from any mailbox on the server. This compromises confidentiality of communications and may expose sensitive information. The attacker does not gain full email content or write access [2].

Mitigation

Users should upgrade to the patched versions: Mail 2.2.1 for Nextcloud 25, Mail 1.14.5 for Nextcloud 22-24, Mail 1.12.9 for Nextcloud 21, and Mail 1.11.8 for Nextcloud 20. No workarounds are available [1][2].