This vulnerability allows users who possess an app password to bypass the mandatory password confirmation step on Nextcloud Server‑sensitive endpoints. By circumventing this additional authentication layer, an attacker with an app password can perform privileged operations—including altering user account settings, modifying files, or changing system configuration—without the explicit consent of the account owner. The flaw maps to CWE‑269, indicating improper authorization or neglecting to enforce sufficient privilege checks.

Nextcloud Server is affected; no specific version information is supplied, so all presently supported releases remain potentially vulnerable until patched. Administrators should assume that any running instance could be impacted unless confirmed otherwise.

The CVSS score of 5.3 suggests a moderate impact when the flaw is exploited. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog. Bypassing password confirmation generally requires access to a valid app password, which may be leaked or guessed, making the attack feasible in environments where app passwords are common. The remedy is to limit app password use or enforce a mandatory confirmation policy.