App Passwords Bypass Password Confirmation on Sensitive Endpoints
CVE-2026-77172 Published on October 27, 2026
App passwords were allowed to bypass password confirmation on sensitive endpoints.
Weakness Type
Improper Privilege Management
The software does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
Products Associated with CVE-2026-77172
Want to know whenever a new CVE is published for Nextcloud Server? stack.watch will email you.
Affected Versions
Nextcloud Server:- Version 32.0.0, <= 34.0.0 is affected.