The Nextcloud Android app (version 3.32.3) contains a bug that could pose privacy risks. Users with multiple Nextcloud accounts connected to the app and automatic upload enabled report that their photos and videos are uploaded not only to the intended folder but also to other connected accounts. This occurs even if automatic upload is not configured for those accounts.
Technical Details and Impact
The bug occurs when the app is set to automatically upload new photos and videos. While uploads are intended for a specific account and folder, the files are additionally placed in other connected accounts. This can be particularly problematic when using both personal and work accounts simultaneously, as sensitive data may be unintentionally uploaded to a business context.
Developer Response
The bug has already been reported in Nextcloud’s GitHub repository and marked as “closed,” indicating that developers are working on a fix. However, it is still unclear when an update resolving the issue will be released.
Recommendations for Users
Until an update is released, users with multiple Nextcloud accounts in the Android app should take the following precautions:
- Disable automatic upload for any account where it is not explicitly required.
- Regularly check folders in all connected accounts to ensure that no unwanted data has been uploaded.
- Consider using alternative sources, such as F-Droid, if a version without the bug is available.
Conclusion
The current bug in the Nextcloud Android app poses a potential privacy risk, especially for users managing multiple accounts simultaneously. It is recommended to temporarily disable automatic uploads and regularly monitor folders in all connected accounts until an official fix is provided.
