CVE-2021-22906

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Nextcloud End-to-End Encryption before 1.5.3, 1.6.3 and 1.7.1 suffers from a denial of service vulnerability due to permitting any authenticated users to lock files of other users.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400 CWE-639

Affected software

Vendor	Product	Versions
n/a	Nextcloud End-to-End Encryption	Fixed in 1.5.3, 1.6.3, 1.7.1

References

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-3829-45wm-ww36Third Party Advisory
https://hackerone.com/reports/1189174Exploit, Issue Tracking, Third Party Advisory
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-3829-45wm-ww36Third Party Advisory
https://hackerone.com/reports/1189174Exploit, Issue Tracking, Third Party Advisory

Timeline

Published: Jun 11, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-229077.8An improper access control vulnerability exists in Citrix Workspace App for Windows potentially allows privilege escalation in CR versions p CVE-2021-229088.8A buffer overflow vulnerability exists in Windows File Resource Profiles in 9.X allows a remote authenticated user with privileges to browse CVE-2021-229097.5A vulnerability found in EdgeMAX EdgeRouter V2.0.9 and earlier could allow a malicious actor to execute a man-in-the-middle (MitM) attack du CVE-2021-22914.7Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prio CVE-2021-229109.8A sanitization vulnerability exists in Rocket.Chat server versions <3.13.2, <3.12.4, <3.11.4 that allowed queries to an endpoint which could CVE-2021-229119.8A improper input sanitization vulnerability exists in Rocket.Chat server 3.11, 3.12 & 3.13 that could lead to unauthenticated NoSQL injectio CVE-2021-229126.5Nextcloud iOS before 3.4.2 suffers from an information disclosure vulnerability when searches for sharees utilize the lookup server by defau CVE-2021-229136.5Nextcloud Deck before 1.2.7, 1.4.1 suffers from an information disclosure vulnerability when searches for sharees utilize the lookup server CVE-2021-229147.5Citrix Cloud Connector before 6.31.0.62192 suffers from insecure storage of sensitive information due to sensitive information being stored CVE-2021-229159.8Nextcloud server before 19.0.11, 20.0.10, 21.0.2 is vulnerable to brute force attacks due to lack of inclusion of IPv6 subnets in rate-limit CVE-2021-229165.9In Brave Desktop between versions 1.17 and 1.26.60, when adblocking is enabled and a proxy browser extension is installed, the CNAME adblock CVE-2021-229176.5Brave Browser Desktop between versions 1.17 and 1.20 is vulnerable to information disclosure by way of DNS requests in Tor windows not flowi