CVE-2021-32654 json
Attacker can obtain write access to any federated share/public link
published 2021-06-01 5 y ago modified 2026-06-17 4 mo ago also EUVD-2021-19474
- cvss
- 8.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.8%
- EPSS 1.8% chance of exploitation in 30 days, percentile 79%
- public exploits
- 0
- none known
Summary
Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.11, 20.0.10, and 21.0.2, an attacker is able to receive write/read privileges on any Federated File Share. Since public links can be added as federated file share, this can also be exploited on any public link. Users can upgrade to patched versions (19.0.11, 20.0.10 or 21.0.2) or, as a workaround, disable federated file sharing.
Patch / fix
- nextcloud nextcloud_server 19.0.11, 20.0.10, 21.0.2
- nextcloud Arch Linux 21.0.2-1
arch linux advisories AVG-2024
Exploit prediction
1.85% chance of exploitation in the next 30 days, higher than 79% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 8.1 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 3.1 | 9.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N |
| NVD | 2.0 | 6.4 | AV:N/AC:L/Au:N/C:P/I:P/A:N |
Affected products
- nextcloud security-advisories
Classification
- Weakness
-
- CWE-639 Authorization Bypass Through User-Controlled Key
References
-
security.gentoo.org
/glsa/202208-17
vendor-advisory, third-party-advisory
-
github.com
/nextcloud/security-advisories/security/advisories/GHSA-jf9h-v24c-22g5
third-party-advisory
-
hackerone.com
/reports/1170024
permissions-required, third-party-advisory
Sources
- CVE List CVE-2021-32654
- NVD CVE-2021-32654
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.