Medium severity · published Oct 27, 2026
CVE-2026-77172
App passwords were allowed to bypass password confirmation on sensitive endpoints
New
5.3
CVSS
–
EPSS
No
On KEV
Description
App passwords were allowed to bypass password confirmation on sensitive endpoints.
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SE
Server · Nextcloud
32.0.0 through 34.0.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-77172
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-77172
hackerone.com
https://hackerone.com/reports/3566607
More from Server
7.5
CVE-2026-77167
Abusing the federated share endpoint, an attacker can write arbitrary rows into the oc_share_external database table
6.5
CVE-2026-77165
File owners were unable to unlock TYPE_TOKEN locks placed by other users, leaving files permanently locked with no recovery path outside of the database
6.5
CVE-2026-82985
The Photos app's filter-based "smart albums" build their file listing using the search configuration (photosSourceFolders) of the user viewing the album, rather than the album…
6.5
CVE-2021-41179
Nextcloud is an open-source, self-hosted productivity platform
6.5
CVE-2021-41178
Nextcloud is an open-source, self-hosted productivity platform