# Please update Nextcloud: Significant security risks
**URL:** https://community.umbrel.com/t/please-update-nextcloud-significant-security-risks/17937
**Category:** General Discussions
**Created:** [June 18, 2024, 9:22pm UTC](https://community.umbrel.com/t/please-update-nextcloud-significant-security-risks/17937 "2024-06-18T21:22:21Z")
**Posts on this page:** 9
**Page:** 1
### Author:  [@denny](https://community.umbrel.com/u/denny)
#### Post date: [June 18, 2024, 9:22pm UTC](https://community.umbrel.com/t/please-update-nextcloud-significant-security-risks/17937/1 "2024-06-18T21:22:21Z")
It’s high time the Nextcloud app on Umbrel OS received an update. The current version, 28.03, has significant security vulnerabilities, particularly concerning two-factor authentication:
> **[Nextcloud: Attackers can bypass two-factor authentication](https://www.heise.de/en/news/Nextcloud-Attackers-can-bypass-two-factor-authentication-9766141.html)**
>
> The cloud service software Nextcloud is vulnerable. The developers have closed several security gaps in current versions.
Addressing these issues promptly is crucial for ensuring the safety and security of all users.
Thank you for your attention to this matter.
---
### Author:  [@doingbobthings](https://community.umbrel.com/u/doingbobthings)
#### Post date: [June 26, 2024, 8:12am UTC](https://community.umbrel.com/t/please-update-nextcloud-significant-security-risks/17937/2 "2024-06-26T08:12:36Z")
I’m running Nextcloud on a shared hosting plan. In Umbrel, can’t you just go to the NC admin panel via your browser, click on your ID at the top right, go to ‘administration settings’ and then upgrade directly in-app?
---
### Author:  [@denny](https://community.umbrel.com/u/denny)
#### Post date: [June 26, 2024, 8:37am UTC](https://community.umbrel.com/t/please-update-nextcloud-significant-security-risks/17937/3 "2024-06-26T08:37:22Z")
No, unfortunately that is not possible. It was already discussed here in another thread.
I’ve already written to support several times and haven’t received a response yet. It’s such a shame… 😩
---
### Author:  [@denny](https://community.umbrel.com/u/denny)
#### Post date: [June 29, 2024, 2:08pm UTC](https://community.umbrel.com/t/please-update-nextcloud-significant-security-risks/17937/4 "2024-06-29T14:08:19Z")
It’s enough to drive me crazy. 🤬
There has been no response from the Umbrel developers for weeks! 😩
I’ll probably have to look for another cloud solution. The security risks are just too great if relevant updates aren’t carried out…
---
### Author:  [@doingbobthings](https://community.umbrel.com/u/doingbobthings)
#### Post date: [July 1, 2024, 12:17pm UTC](https://community.umbrel.com/t/please-update-nextcloud-significant-security-risks/17937/5 "2024-07-01T12:17:39Z")
Why not just run Nextcloud on a standalone Pi? I’ve been running on a Pi4 for years. It’s easy enough to install.
---
### Author:  [@denny](https://community.umbrel.com/u/denny)
#### Post date: [July 10, 2024, 5:43am UTC](https://community.umbrel.com/t/please-update-nextcloud-significant-security-risks/17937/6 "2024-07-10T05:43:42Z")
Because the performance of a Pi is too weak…
I still wonder what is so difficult about updating the Nextcloud app?
Umbrel is not suitable for me as a hosting solution. Very disappointing. 😩
---
### Author:  [@denny](https://community.umbrel.com/u/denny)
#### Post date: [July 26, 2024, 10:06am UTC](https://community.umbrel.com/t/please-update-nextcloud-significant-security-risks/17937/7 "2024-07-26T10:06:05Z")
FYI: [[Update] Nextcloud to 28.0.7 (or 29.0.3) · Issue #1238 · getumbrel/umbrel-apps · GitHub](https://github.com/getumbrel/umbrel-apps/issues/1238)
---
### Author:  [@chiptuner](https://community.umbrel.com/u/chiptuner)
#### Post date: [July 26, 2024, 2:20pm UTC](https://community.umbrel.com/t/please-update-nextcloud-significant-security-risks/17937/8 "2024-07-26T14:20:06Z")
I think NextCloud is one of those the team says is a bit harder to test which is possible why it’s taken so long. If I have time today I may play around with it and submit a PR. natefretz is usually pretty quick at getting completed PRs merged!
---
### Author:  [@denny](https://community.umbrel.com/u/denny)
#### Post date: [August 6, 2024, 8:13pm UTC](https://community.umbrel.com/t/please-update-nextcloud-significant-security-risks/17937/9 "2024-08-06T20:13:01Z")
It’s done. The long-awaited update is finally here. Thanks for the great work! ☂ 🤟
>
>
> This is a major upgrade from version 28.0.3 to 29.0.4. The Nextcloud app on the …Umbrel app store will now receive updates in alignment with the official Nextcloud release schedule moving forward.
>
> \- For new installs: added the nextcloud web container name to the\`NEXTCLOUD\_TRUSTED\_DOMAINS\` env var so that apps like ONLYOFFICE Docs can communicate via Docker dns
> \- For existing installs: added a post-update hook that adds the nextcloud web container name to trusted\_domains in config.php.
>
> Tested fresh install and update.