Data disclosure via unchecked public key

Nextcloud Android Client before 3.16.1 allows remote authenticated users to expose end-to-end encrypted data via a malicious public key. During end-to-end encryption device setup, the client downloads a public certificate and private key but skips checking that the private key belongs to the previously downloaded certificate, so a malicious Nextcloud instance can substitute its own public key and receive encrypted data. The attack requires an authenticated user to add an additional encrypted device against a malicious or compromised server; the consequence is confidentiality loss without demonstrated integrity or availability impact.