{"id":"CVE-2019-15611","url":"https://www.cyber-defence.io/tools/cve/CVE-2019-15611","generatedAt":"2026-10-28T22:21:46.745Z","title":"Violation of Secure Design Principles in the iOS App 2.23.0 causes the app to leak its login and token to other Nextcloud services when search e.g. for federated users or registering for push notifications.","description":"Violation of Secure Design Principles in the iOS App 2.23.0 causes the app to leak its login and token to other Nextcloud services when search e.g. for federated users or registering for push notifications.","published":"2020-02-04T20:15:12.000Z","lastModified":"2026-06-17T02:20:45.000Z","status":"Modified","sourceIdentifier":"support@hackerone.com","cvss":{"version":"3.1","score":4.9,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"},"cwe":["CWE-657"],"affected":["nextcloud/nextcloud"],"epss":{"score":0.01081,"percentile":0.64944,"date":"2026-10-27","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (1.08%). Track it; it rarely justifies an emergency change on its own."},"changes":[],"references":[{"url":"https://hackerone.com/reports/672623","tags":["Permissions Required","Third Party Advisory"],"source":"support@hackerone.com"},{"url":"https://nextcloud.com/security/advisory/?id=NC-SA-2019-017","tags":["Vendor Advisory"],"source":"support@hackerone.com"},{"url":"https://hackerone.com/reports/672623","tags":["Permissions Required","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://nextcloud.com/security/advisory/?id=NC-SA-2019-017","tags":["Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2019-15611","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}