CVE-2021-41239

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

Nextcloud server is a self hosted system designed to provide cloud style services. In affected versions the User Status API did not consider the user enumeration settings by the administrator. This allowed a user to enumerate other users on the instance, even when user listings where disabled. It is recommended that the Nextcloud Server is upgraded to 20.0.14, 21.0.6 or 22.2.1. There are no known workarounds.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200CWE-862

Affected software

No affected versions have been published.

Timeline

Published
Mar 8, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-41246.1janus-gateway is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2021-412414.3Nextcloud server is a self hosted system designed to provide cloud style services. The groupfolders application for Nextcloud allows sharingCVE-2021-412428.1OpenOlat is a web-basedlearning management system. A path traversal vulnerability exists in OpenOlat prior to versions 15.5.12 and 16.0.5. BCVE-2021-412438.8There is a Potential Zip Slip Vulnerability and OS Command Injection Vulnerability on the management system of baserCMS. Users with permissiCVE-2021-412447.2Grafana is an open-source platform for monitoring and observability. In affected versions when the fine-grained access control beta feature CVE-2021-412458.1Combodo iTop is a web based IT Service Management tool. In versions prior to 2.7.6 and 3.0.0, CSRF tokens generated by `privUITransactionFilCVE-2021-412468.8Express OpenID Connect is express JS middleware implementing sign on for Express web apps using OpenID Connect. Versions before and includinCVE-2021-412477.5JupyterHub is an open source multi-user server for Jupyter notebooks. In affected versions users who have multiple JupyterLab tabs open in tCVE-2021-412484.7GraphiQL is the reference implementation of this monorepo, GraphQL IDE, an official project under the GraphQL Foundation. All versions of grCVE-2021-412494.7GraphQL Playground is a GraphQL IDE for development of graphQL focused applications. All versions of graphql-playground-react older than graCVE-2021-41258.1It was found that the original fix for log4j CVE-2021-44228 and CVE-2021-45046 in the OpenShift metering hive containers was incomplete, as CVE-2021-412504.3Python discord bot is the community bot for the Python Discord community. In affected versions when a non-blacklisted URL and an otherwise t
CVE-2021-41239: Medium severity, CVSS 5.3 | Vulnix