Missing validation of server certificates for out-going connections in Nextcloud Social < 0.4.0 allowed a man-in-the-middle attack.
- https://hackerone.com/reports/915585
No PoCs found on GitHub currently.