An issue in the Nextcloud Android client (build versionCode 30390190) enables an attacker to force a logged‑in user to log out and then switch them to an attacker‑controlled profile. This bypasses the app’s authentication controls entirely, allowing the attacker to gain access to the victim’s account and data without compromising credentials.

The vulnerability affects the Nextcloud Android application. The specific affected build is the Android client with version code 30390190. No other vendors or products are listed as impacted.

The flaw permits an attacker to compel a logged‑in user to log out and switch to an attacker‑controlled profile, thereby bypassing authentication and potentially allowing the attacker to take over the victim’s account and access or modify data. No EPSS score is available, and the issue is not listed in CISA’s KEV catalog. The likely attack vector involves manipulating the client’s authentication flow on the victim device and does not require elevated system privileges.