In Nextcloud Server, pre‑2FA session cookies can be reused as Bearer tokens to authenticate against DAV endpoints, allowing an attacker to read or modify files. This flaw represents a credential‑reuse weakness (CWE‑287) that bypasses mandatory two‑factor authentication and gives the user full access to the contents of the affected account.

The vulnerability affects Nextcloud Server releases from 32.0.0 through 32.0.8 and 33.0.0 through 33.0.2. Enterprise Server versions 31.0.14.5, 30.0.17.9, and 29.0.16.16 are also impacted.

With a CVSS score of 5.9 the flaw is considered moderate. No EPSS score is available, and it is not currently listed in CISA’s KEV catalog. An attacker with a pre‑2FA session cookie can use that token to access DAV endpoints without completing TOTP, thereby gaining read/write privileges. The exploit is relatively straightforward once the session cookie is obtained, and the vulnerability does not allow arbitrary code execution but does compromise confidentiality and integrity of stored data.