Medium severity · published Oct 25, 2021
CVE-2021-41179
Nextcloud is an open-source, self-hosted productivity platform
6.5
CVSS
1.2%
EPSS
No
On KEV
Description
Nextcloud is an open-source, self-hosted productivity platform. Prior to Nextcloud Server versions 20.0.13, 21.0.5, and 22.2.0, the Two-Factor Authentication wasn't enforced for pages marked as public. Any page marked as `@PublicPage` could thus be accessed with a valid user session that isn't authenticated. This particularly affects the Nextcloud Talk application, as this could be leveraged to gain access to any private chat channel without going through the Two-Factor flow. It is recommended that the Nextcloud Server be upgraded to 20.0.13, 21.0.5 or 22.2.0. There are no known workarounds aside from upgrading.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 68% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SE
Server · Nextcloud
20.0.3 before 20.0.13; 21.0.1 before 21.0.5; 22.1.1 before 22.2.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-41179
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-41179
Third Party Advisory
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-7hvh-rc6f-px23
Patch
https://github.com/nextcloud/server/pull/28725
Permissions Required
https://hackerone.com/reports/1322865
More from Server
7.5
CVE-2026-77167
Abusing the federated share endpoint, an attacker can write arbitrary rows into the oc_share_external database table
6.5
CVE-2026-77165
File owners were unable to unlock TYPE_TOKEN locks placed by other users, leaving files permanently locked with no recovery path outside of the database
6.5
CVE-2026-82985
The Photos app's filter-based "smart albums" build their file listing using the search configuration (photosSourceFolders) of the user viewing the album, rather than the album…
6.5
CVE-2021-41178
Nextcloud is an open-source, self-hosted productivity platform
6.2
CVE-2026-77164
Circles' remote-instance signature verification fetches the attacker-supplied keyId URL before trust in the remote instance is established, and explicitly allows local/private…