App lockout in nextcloud Android app can be bypassed via thirdparty apps

Vulnerability

Nextcloud Android versions 3.7.0 through 3.24.0 contain a vulnerability that allows an attacker with physical access to an unlocked device to bypass the Nextcloud app's PIN/passcode protection via a third-party application. The issue arises because activities extending AuthenticatorActivity running as singleTask can trigger PassCodeManager.onActivityResumed twice (on onResume and on onNewIntent), allowing the passcode check to be circumvented [1][2].

Exploitation

An attacker must have physical access to an unlocked device. By using a third-party app that generates a deep link or otherwise interacts with the Nextcloud app, the attacker can trigger the vulnerable code path that skips the PIN/passcode prompt. No authentication or special privileges beyond physical access to an unlocked device are required [1][2].

Impact

Successful exploitation allows the attacker to view file metadata—specifically the sharer, sharees, and activity information—without entering the app's PIN or passcode. The attacker does not gain full file contents or arbitrary code execution, but sensitive metadata about file sharing and user activity is exposed [2].

Mitigation

Upgrade to Nextcloud Android version 3.24.1, released March 2023, which fixes the issue by ensuring the passcode check is not bypassed when activities are restarted [1][2]. No workarounds are available; users must update the app to mitigate the vulnerability [2].