Impact

Due to a timeout issue the Android client may not properly clean all sensitive data on account removal. This could include sensitive key material such as the End-to-End encryption keys.

Patches

It is recommended that the Nextcloud Android App is upgraded to 3.16.1.

Workarounds

None.

References

• HackerOne

For more information

If you have any questions or comments about this advisory:

• Create a post in nextcloud/security-advisories
• Customers: Open a support ticket at support.nextcloud.com