CVE-2019-15611: 
NixOS vulnerability analysis and mitigation

A vulnerability in the iOS App version 2.23.0 of Nextcloud was identified as CVE-2019-15611. The vulnerability involves a violation of secure design principles that causes the app to leak login credentials and tokens to other Nextcloud services when performing operations such as searching for federated users or registering for push notifications (HackerOne, Nextcloud Advisory).

The vulnerability stems from a violation of secure design principles in the iOS application's authentication handling mechanism. When users perform specific operations like federated user searches or push notification registration, the app inadvertently exposes login credentials and authentication tokens to other Nextcloud services (CVE Mitre).

The vulnerability could lead to unauthorized access to user accounts as login credentials and authentication tokens could be exposed to other Nextcloud services, potentially compromising user account security (HackerOne).

Users should upgrade to a version newer than iOS App 2.23.0 that contains the security fix. The vulnerability was addressed in a subsequent release as detailed in the Nextcloud security advisory (Nextcloud Advisory).