CVE-2021-32680

LowCVSS 3.3/10Last modified Jun 17, 2026

Description

Nextcloud Server is a Nextcloud package that handles data storage. In versions priot to 19.0.13, 20.0.11, and 21.0.3, Nextcloud Server audit logging functionality wasn't properly logging events for the unsetting of a share expiration date. This event is supposed to be logged. This issue is patched in versions 19.0.13, 20.0.11, and 21.0.3.

Metrics

CVSS 3.1 3.3/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-778

Affected software

Vendor	Product	Versions
nextcloud	security-advisories	< 19.0.13; >= 20.0.0, < 20.0.11; >= 21.0.0, < 21.0.3

References

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-fxpq-wq7c-vppfThird Party Advisory
https://github.com/nextcloud/server/pull/27024Patch, Third Party Advisory
https://hackerone.com/reports/1200810Permissions Required
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BVZS26RDME2DYTKET5AECRIZDFUGR2AZ/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J63NBVPR2AQCAWRNDOZSGRY5II4WS2CZ/
https://security.gentoo.org/glsa/202208-17Third Party Advisory
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-fxpq-wq7c-vppfThird Party Advisory
https://github.com/nextcloud/server/pull/27024Patch, Third Party Advisory
https://hackerone.com/reports/1200810Permissions Required
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BVZS26RDME2DYTKET5AECRIZDFUGR2AZ/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J63NBVPR2AQCAWRNDOZSGRY5II4WS2CZ/
https://security.gentoo.org/glsa/202208-17Third Party Advisory

Timeline

Published: Jul 12, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-326815.4Wagtail is an open source content management system built on Django. A cross-site scripting vulnerability exists in versions 2.13-2.13.1, ve CVE-2021-326829.8elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Several vulnerabilities affect elFinder 2.1.58. Thes CVE-2021-326836.1wire-webapp is the web version of Wire, an open-source messenger. A cross-site scripting vulnerability exists in wire-webapp prior to versio CVE-2021-326845.5magento-scripts contains scripts and configuration used by Create Magento App, a zero-configuration tool-chain which allows one to deploy Ma CVE-2021-326859.8tEnvoy contains the PGP, NaCl, and PBKDF2 in node.js and the browser (hashing, random, encryption, decryption, signatures, conversions), use CVE-2021-326865.9PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SD CVE-2021-326877.5Redis is an open source, in-memory database that persists on disk. An integer overflow bug affecting all versions of Redis can be exploited CVE-2021-326888.8Nextcloud Server is a Nextcloud package that handles data storage. Nextcloud Server supports application specific tokens for authentication CVE-2021-326896.5Nextcloud Talk is a fully on-premises audio/video and chat communication service. In versions prior to 11.2.2, if a user was able to reuse a CVE-2021-326908.6Helm is a tool for managing Charts (packages of pre-configured Kubernetes resources). In versions of helm prior to 3.6.1, a vulnerability ex CVE-2021-326919.8Apollos Apps is an open source platform for launching church-related apps. In Apollos Apps versions prior to 2.20.0, new user registrations CVE-2021-326929.6Activity Watch is a free and open-source automated time tracker. Versions prior to 0.11.0 allow an attacker to execute arbitrary commands on