CVE-2021-32652

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Nextcloud Mail is a mail app for the Nextcloud platform. A missing permission check in Nextcloud Mail before 1.4.3 and 1.8.2 allows another authenticated users to access mail metadata of other users. Versions 1.4.3 and 1.8.2 contain patches for this vulnerability; no workarounds other than the patches are known to exist.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-284 CWE-862

Affected software

Vendor	Product	Versions
nextcloud	security-advisories	< 1.4.3; >= 1.5.5, < 1.8.2

References

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-mxx2-6rg9-v2vcThird Party Advisory
https://hackerone.com/reports/1094063Exploit, Third Party Advisory
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-mxx2-6rg9-v2vcThird Party Advisory
https://hackerone.com/reports/1094063Exploit, Third Party Advisory

Timeline

Published: Jun 1, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-326532.7Nextcloud Server is a Nextcloud package that handles data storage. Nextcloud Server versions prior to 19.0.11, 20.0.10, or 21.0.2 send user CVE-2021-326549.1Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.11, 20.0.10, and 21.0.2, an attacker is able to CVE-2021-326553.5Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.11, 20.0.10, and 21.0.2, an attacker is able to CVE-2021-326568.6Nextcloud Server is a Nextcloud package that handles data storage. A vulnerability in federated share exists in versions prior to 19.0.11, 2 CVE-2021-326574.3Nextcloud Server is a Nextcloud package that handles data storage. In versions of Nextcloud Server prior to 10.0.11, 20.0.10, and 21.0.2, a CVE-2021-326584.6Nextcloud Android is the Android client for the Nextcloud open source home cloud system. Due to a timeout issue the Android client may not p CVE-2021-326594.9Matrix-appservice-bridge is the bridging service for the Matrix communication program's application services. In versions 2.6.0 and earlier,CVE-2021-326608.1Backstage is an open platform for building developer portals, and techdocs-common contains common functionalities for Backstage's TechDocs. CVE-2021-326617.3Backstage is an open platform for building developer portals. In versions of Backstage's Techdocs Plugin (`@backstage/plugin-techdocs`) prio CVE-2021-326626.5Backstage is an open platform for building developer portals, and techdocs-common contains common functionalities for Backstage's TechDocs. CVE-2021-326637.5iTop is an open source web based IT Service Management tool. In affected versions an attacker can call the system setup without authenticati CVE-2021-326644.8Combodo iTop is an open source web based IT Service Management tool. In affected versions there is a XSS vulnerability on "run query" page w