CVE-2019-15611
No sign of exploitation. No public exploitation artifact known so far.
The Nextcloud iOS app version 2.23.0 unintentionally shares user login credentials and authentication tokens with other Nextcloud services during certain operations like searching for federated users or setting up push notifications. This exposes sensitive authentication data that should remain private.
The application violates secure design principles by transmitting authentication credentials and session tokens to external Nextcloud services without proper isolation or credential handling during federated user search and push notification registration flows. An attacker controlling a federated Nextcloud instance or intercpting inter-service communication could capture exposed credentials, potentially leading to unauthorized access across multiple Nextcloud deployments.