Nextcloud · Report #308156
Email Notification should be get while changing password on apps.nextcloud.com
Informativestatus
7upvotes
28 Feb 2018disclosed
How it was found
Hi,
There is an issue with password reset functionality with Nextcloud: user is not receiving notification when he reset password.
Issue: user not always gets a notification about password change. When user change his password then a notification is not send to the user.
It is good to always send email notification for user when a password change.
Impact
It would be critical issue if user kept his/her account logged-in into PC or cyber cafe, then attacker can change his/her password without knowing to the user. Please letme know if you have further questions