CVE-2021-32655

LowCVSS 3.5/10Last modified Jun 17, 2026

Description

Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.11, 20.0.10, and 21.0.2, an attacker is able to convert a Files Drop link to a federated share. This causes an issue on the UI side of the sharing user. When the sharing user opens the sharing panel and tries to remove the "Create" privileges of this unexpected share, Nextcloud server would silently grant the share read privileges. The vulnerability is patched in versions 19.0.11, 20.0.10 and 21.0.2. No workarounds are known to exist.

Metrics

CVSS 3.1 3.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-241

Affected software

No affected versions have been published.

Timeline

Published: Jun 1, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-326568.6Nextcloud Server is a Nextcloud package that handles data storage. A vulnerability in federated share exists in versions prior to 19.0.11, 2 CVE-2021-326574.3Nextcloud Server is a Nextcloud package that handles data storage. In versions of Nextcloud Server prior to 10.0.11, 20.0.10, and 21.0.2, a CVE-2021-326584.6Nextcloud Android is the Android client for the Nextcloud open source home cloud system. Due to a timeout issue the Android client may not p CVE-2021-326594.9Matrix-appservice-bridge is the bridging service for the Matrix communication program's application services. In versions 2.6.0 and earlier,CVE-2021-326608.1Backstage is an open platform for building developer portals, and techdocs-common contains common functionalities for Backstage's TechDocs. CVE-2021-326617.3Backstage is an open platform for building developer portals. In versions of Backstage's Techdocs Plugin (`@backstage/plugin-techdocs`) prio CVE-2021-326626.5Backstage is an open platform for building developer portals, and techdocs-common contains common functionalities for Backstage's TechDocs. CVE-2021-326637.5iTop is an open source web based IT Service Management tool. In affected versions an attacker can call the system setup without authenticati CVE-2021-326644.8Combodo iTop is an open source web based IT Service Management tool. In affected versions there is a XSS vulnerability on "run query" page w CVE-2021-326656.5wire-ios is the iOS version of Wire, an open-source secure messaging app. wire-ios versions 3.8.0 and earlier have a bug in which a conversa CVE-2021-326666.5wire-ios is the iOS version of Wire, an open-source secure messaging app. In wire-ios versions 3.8.0 and prior, a vulnerability exists that CVE-2021-326675.4TYPO3 is an open source PHP based web content management system. Versions 9.0.0 through 9.5.28, 10.0.0 through 10.4.17, and 11.0.0 through 1