UpHeron
All vulnerabilities

Servers and applications

CVE-2021-32688

Nextcloud Server is a Nextcloud package that handles data storage. Nextcloud Server supports application specific tokens for authentication purposes. These tokens are supposed to be granted to a specific applications (e.g. DAV sync clients), and can also be configured by the user to not have any filesystem access. Due to a lacking permission check, the tokens were able to change their own…

Severity
High 8.8
Published
12 Jul 2021
Last changed
17 Jun 2026
Added to UpHeron
21 Oct 2026
Fixed in
19.0.13, 20.0.11, 21.0.3
Sources
NVD

Affected software

SoftwareAffected versions
NextcloudServers and applications · cpe:a:nextcloud:nextcloud_server
  • Every version before 19.0.13
  • From 20.0.0 before 20.0.11
  • From 21.0.0 before 21.0.3

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2021-32688
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2021-32688