CVE-2026-45153: Nextcloud Files Auth Bypass Vulnerability

CVE-2026-45153 Overview

CVE-2026-45153 is an authentication bypass vulnerability in the Nextcloud Android Files app. The flaw affects versions 33.0.0 up to but not including 33.1.0. An attacker with physical access to an unlocked Android device can press the back button after the phone unlock screen to bypass the Files app PIN protection. The issue is classified under [CWE-287: Improper Authentication]. Nextcloud has patched the vulnerability in version 33.1.0.

Critical Impact
An attacker with physical access to an unlocked Android device can bypass the Nextcloud Files app PIN and access confidential files stored within the app.

Affected Products

Nextcloud Android Files app version 33.0.0
Nextcloud Android Files app versions up to but not including 33.1.0
Patched in Nextcloud Android Files app version 33.1.0

Discovery Timeline

2026-06-01 - CVE-2026-45153 published to the National Vulnerability Database
2026-06-01 - Last updated in NVD database

Technical Details for CVE-2026-45153

Vulnerability Analysis

The Nextcloud Android Files app provides an in-app PIN to gate access to stored files. This control supplements the Android device lock and protects data when the device is unlocked but unattended. The vulnerability allows an attacker who already has the device unlocked to defeat the PIN prompt by pressing the Android back button immediately after the device is unlocked. The Files app then renders its contents without enforcing PIN verification.

The weakness is an authentication state handling flaw on a UI navigation path. The PIN screen is dismissable through a system navigation gesture instead of blocking until valid credentials are supplied. Confidentiality is the primary asset at risk; an attacker reaches file contents stored in the app context. Because exploitation requires physical access and a previously unlocked device, the practical attack surface is limited to lost, stolen, or unattended phones.

Root Cause

The root cause is improper enforcement of the PIN authentication state after a system-level lock transition. The activity backing the PIN entry view did not treat the back action as a denial of access. Instead, navigating back returned the user to the underlying Files activity, which had already been initialized. The patch in version 33.1.0 ensures the PIN screen blocks downstream activity rendering until the correct PIN is supplied. See the Nextcloud security advisory GHSA-2w7v-5299-3hw5 and the corresponding Nextcloud Android pull request 16896 for the code-level fix.

Attack Vector

The attack vector is physical. An attacker needs the target Android device in an unlocked state, with the Nextcloud Files app installed and a PIN configured. The attacker opens or returns to the Files app, then presses the system back button when the PIN screen appears. The Files app exposes its file listing and contents without prompting again. See the HackerOne report 3625210 for the original disclosure.

Detection Methods for CVE-2026-45153

Indicators of Compromise

No file-system or network indicators exist for this vulnerability because exploitation is a local UI navigation action that produces no telemetry on the device or server.
Unexpected access events on the Nextcloud server originating from a known-lost or known-stolen device may indicate post-exploitation activity.

Detection Strategies

Audit Nextcloud server access logs for file reads from mobile clients tied to devices reported as lost, stolen, or shared.
Correlate Android mobile device management (MDM) events such as lock-state changes with Nextcloud session activity to spot anomalous access windows.
Track the installed version of the Nextcloud Android app across the device fleet and flag any instance below 33.1.0.

Monitoring Recommendations

Enable session and access logging in the Nextcloud server and forward logs to a central SIEM for retention and analysis.
Monitor MDM compliance reports for devices that fall behind on the Nextcloud Android app version.
Alert on Nextcloud authentication or file access events from devices flagged as missing through your endpoint or MDM platform.

How to Mitigate CVE-2026-45153

Immediate Actions Required

Update the Nextcloud Android Files app to version 33.1.0 or later on all managed and personal devices that connect to Nextcloud.
Revoke active app passwords and device tokens in the Nextcloud server for any device suspected of unauthorized physical access.
Require Android device-level screen lock with a strong PIN, password, or biometric in addition to the Files app PIN.

Patch Information

Nextcloud released the fix in the Android Files app version 33.1.0. Distribute the update through Google Play, F-Droid, or your enterprise mobile application management channel. The code change is described in the Nextcloud Android pull request 16896 and the Nextcloud security advisory GHSA-2w7v-5299-3hw5.

Workarounds

Enforce a short Android device auto-lock timeout through MDM so an unattended phone returns to the system lock screen quickly.
Instruct users to fully close the Nextcloud Files app from the recent apps list when they are not actively using it.
Enable remote wipe through Android device management for any device reported lost or stolen to remove cached Nextcloud data.

bash

# Example: query installed Nextcloud Android Files app version via adb
adb shell dumpsys package com.nextcloud.client | grep versionName