CVE-2021-32657

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Nextcloud Server is a Nextcloud package that handles data storage. In versions of Nextcloud Server prior to 10.0.11, 20.0.10, and 21.0.2, a malicious user may be able to break the user administration page. This would disallow administrators to administrate users on the Nextcloud instance. The vulnerability is fixed in versions 19.0.11, 20.0.10, and 21.0.2. As a workaround, administrators can use the OCC command line tool to administrate the Nextcloud users.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-400

Affected software

Vendor	Product	Versions
nextcloud	security-advisories	< 19.0.11; >= 20.0.0, < 20.0.10; >= 21.0.0, < 21.0.2

References

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-fx62-q47f-f665Third Party Advisory
https://hackerone.com/reports/1147611Third Party Advisory
https://security.gentoo.org/glsa/202208-17Third Party Advisory
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-fx62-q47f-f665Third Party Advisory
https://hackerone.com/reports/1147611Third Party Advisory
https://security.gentoo.org/glsa/202208-17Third Party Advisory

Timeline

Published: Jun 1, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-326584.6Nextcloud Android is the Android client for the Nextcloud open source home cloud system. Due to a timeout issue the Android client may not p CVE-2021-326594.9Matrix-appservice-bridge is the bridging service for the Matrix communication program's application services. In versions 2.6.0 and earlier,CVE-2021-326608.1Backstage is an open platform for building developer portals, and techdocs-common contains common functionalities for Backstage's TechDocs. CVE-2021-326617.3Backstage is an open platform for building developer portals. In versions of Backstage's Techdocs Plugin (`@backstage/plugin-techdocs`) prio CVE-2021-326626.5Backstage is an open platform for building developer portals, and techdocs-common contains common functionalities for Backstage's TechDocs. CVE-2021-326637.5iTop is an open source web based IT Service Management tool. In affected versions an attacker can call the system setup without authenticati CVE-2021-326644.8Combodo iTop is an open source web based IT Service Management tool. In affected versions there is a XSS vulnerability on "run query" page w CVE-2021-326656.5wire-ios is the iOS version of Wire, an open-source secure messaging app. wire-ios versions 3.8.0 and earlier have a bug in which a conversa CVE-2021-326666.5wire-ios is the iOS version of Wire, an open-source secure messaging app. In wire-ios versions 3.8.0 and prior, a vulnerability exists that CVE-2021-326675.4TYPO3 is an open source PHP based web content management system. Versions 9.0.0 through 9.5.28, 10.0.0 through 10.4.17, and 11.0.0 through 1 CVE-2021-326684.8TYPO3 is an open source PHP based web content management system. Versions 9.0.0 through 9.5.28, 10.0.0 through 10.4.17, and 11.0.0 through 1 CVE-2021-326695.4TYPO3 is an open source PHP based web content management system. Versions 9.0.0 through 9.5.28, 10.0.0 through 10.4.17, and 11.0.0 through 1