CVE-2021-41241

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Nextcloud server is a self hosted system designed to provide cloud style services. The groupfolders application for Nextcloud allows sharing a folder with a group of people. In addition, it allows setting "advanced permissions" on subfolders, for example, a user could be granted access to the groupfolder but not specific subfolders. Due to a lacking permission check in affected versions, a user could still access these subfolders by copying the groupfolder to another location. It is recommended that the Nextcloud Server is upgraded to 20.0.14, 21.0.6 or 22.2.1. Users unable to upgrade should disable the "groupfolders" application in the admin settings.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-863CWE-862

Affected software

No affected versions have been published.

Timeline

Published
Mar 8, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-412428.1OpenOlat is a web-basedlearning management system. A path traversal vulnerability exists in OpenOlat prior to versions 15.5.12 and 16.0.5. BCVE-2021-412438.8There is a Potential Zip Slip Vulnerability and OS Command Injection Vulnerability on the management system of baserCMS. Users with permissiCVE-2021-412447.2Grafana is an open-source platform for monitoring and observability. In affected versions when the fine-grained access control beta feature CVE-2021-412458.1Combodo iTop is a web based IT Service Management tool. In versions prior to 2.7.6 and 3.0.0, CSRF tokens generated by `privUITransactionFilCVE-2021-412468.8Express OpenID Connect is express JS middleware implementing sign on for Express web apps using OpenID Connect. Versions before and includinCVE-2021-412477.5JupyterHub is an open source multi-user server for Jupyter notebooks. In affected versions users who have multiple JupyterLab tabs open in tCVE-2021-412484.7GraphiQL is the reference implementation of this monorepo, GraphQL IDE, an official project under the GraphQL Foundation. All versions of grCVE-2021-412494.7GraphQL Playground is a GraphQL IDE for development of graphQL focused applications. All versions of graphql-playground-react older than graCVE-2021-41258.1It was found that the original fix for log4j CVE-2021-44228 and CVE-2021-45046 in the OpenShift metering hive containers was incomplete, as CVE-2021-412504.3Python discord bot is the community bot for the Python Discord community. In affected versions when a non-blacklisted URL and an otherwise tCVE-2021-412515.9@sap-cloud-sdk/core contains the core functionality of the SAP Cloud SDK as well as the SAP Business Technology Platform abstractions. This CVE-2021-412525.4Kirby is an open source file structured CMS ### Impact Kirby's writer field stores its formatted content as HTML code. Unlike with other fie
CVE-2021-41241: Medium severity, CVSS 4.3 | Vulnix