The Nextcloud VM is all about convenience. Easy to setup, and with as little hassle as possible. One of the things that we did to make it easier for all the new Nextcloud users was to pre-define a temporary email account in case you didn’t know that setting existed. We did this to deliver the full experience of Nextcloud, sending notifications, calendar invitations, and so on. Of course our intention was never for anyone to abuse this and we set 2FA on the login to make it really hard to access.

What we didn’t think of was that it was still possible to access all those mails from almost any email client. The password was in the code and you just had to enter it to setup an account with all the emails in it. Not good! It came to our attention just a few hours ago, and we have now corrected this mistake and deleted the account. We urge everyone to setup their own email account in the Admin setting of Nextcloud.

First go to the admin settings and click Additional Settings


Then fill in your information in in the Email Server settings. Hit Store credentials and Send email to test that the settings are working.

Now you Nextcloud will send out notifications again.