CVE-2021-32654

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.11, 20.0.10, and 21.0.2, an attacker is able to receive write/read privileges on any Federated File Share. Since public links can be added as federated file share, this can also be exploited on any public link. Users can upgrade to patched versions (19.0.11, 20.0.10 or 21.0.2) or, as a workaround, disable federated file sharing.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-639

Affected software

No affected versions have been published.

Timeline

Published: Jun 1, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-326553.5Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.11, 20.0.10, and 21.0.2, an attacker is able to CVE-2021-326568.6Nextcloud Server is a Nextcloud package that handles data storage. A vulnerability in federated share exists in versions prior to 19.0.11, 2 CVE-2021-326574.3Nextcloud Server is a Nextcloud package that handles data storage. In versions of Nextcloud Server prior to 10.0.11, 20.0.10, and 21.0.2, a CVE-2021-326584.6Nextcloud Android is the Android client for the Nextcloud open source home cloud system. Due to a timeout issue the Android client may not p CVE-2021-326594.9Matrix-appservice-bridge is the bridging service for the Matrix communication program's application services. In versions 2.6.0 and earlier,CVE-2021-326608.1Backstage is an open platform for building developer portals, and techdocs-common contains common functionalities for Backstage's TechDocs. CVE-2021-326617.3Backstage is an open platform for building developer portals. In versions of Backstage's Techdocs Plugin (`@backstage/plugin-techdocs`) prio CVE-2021-326626.5Backstage is an open platform for building developer portals, and techdocs-common contains common functionalities for Backstage's TechDocs. CVE-2021-326637.5iTop is an open source web based IT Service Management tool. In affected versions an attacker can call the system setup without authenticati CVE-2021-326644.8Combodo iTop is an open source web based IT Service Management tool. In affected versions there is a XSS vulnerability on "run query" page w CVE-2021-326656.5wire-ios is the iOS version of Wire, an open-source secure messaging app. wire-ios versions 3.8.0 and earlier have a bug in which a conversa CVE-2021-326666.5wire-ios is the iOS version of Wire, an open-source secure messaging app. In wire-ios versions 3.8.0 and prior, a vulnerability exists that