Alacn1

**Name of the Vulnerable Software and Affected Versions** Nextcloud Server versions 25.0.0 through 25.0.10 Nextcloud Server versions 26.0.0 through 26.0.5 Nextcloud Server versions 27.0.0 through 27.0.0 (prior to 27.1.0) Nextcloud Enterprise Server versions 25.0.0 through 25.0.10 Nextcloud Enterprise Server versions 26.0.0 through 26.0.5 Nextcloud Enterprise Server versions 27.0.0 through 27.0.0 (prior to 27.1.0) **Description** The issue is related to the storage of critical information in plaintext. When the log level is set to debug in Nextcloud Server, the user ldap app logs user passwords in plaintext into the log file. If the log file is leaked or shared, the users' passwords would be leaked. **Recommendations** For Nextcloud Server and Nextcloud Enterprise Server versions prior to 25.0.11, 26.0.6, and 27.1.0, update to version 25.0.11, 26.0.6, or 27.1.0 to resolve the issue. As a temporary workaround for all affected versions, change the config setting `loglevel` to `1` or higher. Restrict access to the log file to minimize the risk of exploitation.