CVE-2016-9462: Nextcloud Server

Medium severity, CVSS 4.3. EPSS: 1.9% chance of exploitation in the next 30 days.

Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are not properly verifying restore privileges when restoring a file. The restore capability of Nextcloud/ownCloud was not verifying whether a user has only read-only access to a share. Thus a user with read-only access was able to restore old versions.

Affected products

• Nextcloud Nextcloud Server: before 9.0.52 (fixed in 9.0.52)
• ownCloud ownCloud: before 9.0.4 (fixed in 9.0.4)

Published 2017-03-28. Last modified 2026-06-17.