{"id":"BIT-nextcloud-2026-45153","summary":"Nextcloud: PIN bypass in PassCodeActivity via back button","details":"Nextcloud is an open source content collaboration platform. From version 33.0.0 to before version 33.1.0, after unlocking a locked Android phone the back-button could be used to bypass the Nextcloud Files app PIN. This issue has been patched in version 33.1.0.","aliases":["CVE-2026-45153","GHSA-2w7v-5299-3hw5"],"modified":"2026-07-13T06:26:09.390858604Z","published":"2026-07-12T23:48:00.245Z","database_specific":{"cpes":["cpe:2.3:a:nextcloud:nextcloud:*:*:*:*:*:android:*:*"],"severity":"Medium"},"references":[{"type":"WEB","url":"https://github.com/nextcloud/android/pull/16896"},{"type":"WEB","url":"https://github.com/nextcloud/security-advisories/security/advisories/GHSA-2w7v-5299-3hw5"},{"type":"WEB","url":"https://hackerone.com/reports/3625210"},{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45153"}],"affected":[{"package":{"name":"nextcloud","ecosystem":"Bitnami","purl":"pkg:bitnami/nextcloud"},"ranges":[{"type":"SEMVER","events":[{"introduced":"33.0.0"},{"fixed":"33.1.0"}]}],"database_specific":{"source":"https://github.com/bitnami/vulndb/tree/main/data/nextcloud/BIT-nextcloud-2026-45153.json"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:P/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N"}]}],"schema_version":"1.7.5"}