Impact
An attacker is able to overwrite the local_message_id for draft attachments or delete them, making it unavailable for the actual sender in both cases. It is not possible to send the attachment to another user or to access it.
Patches
It is recommended that the Nextcloud Mail app is upgraded to 1.12.2 .
Workarounds
No workaround available
References
For more information
If you have any questions or comments about this advisory:
Impact
An attacker is able to overwrite the local_message_id for draft attachments or delete them, making it unavailable for the actual sender in both cases. It is not possible to send the attachment to another user or to access it.
Patches
It is recommended that the Nextcloud Mail app is upgraded to 1.12.2 .
Workarounds
No workaround available
References
For more information
If you have any questions or comments about this advisory: