CVE-2021-41241

MEDIUM

Nextcloud Server < 20.0.14 - Missing Authorization in Groupfolders Subfolder Access

Title source: llm
STIX 2.1

Description

Nextcloud server is a self hosted system designed to provide cloud style services. The groupfolders application for Nextcloud allows sharing a folder with a group of people. In addition, it allows setting "advanced permissions" on subfolders, for example, a user could be granted access to the groupfolder but not specific subfolders. Due to a lacking permission check in affected versions, a user could still access these subfolders by copying the groupfolder to another location. It is recommended that the Nextcloud Server is upgraded to 20.0.14, 21.0.6 or 22.2.1. Users unable to upgrade should disable the "groupfolders" application in the admin settings.

References (4)

Core 4
Core References
Issue Tracking, Third Party Advisory x_refsource_confirm
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-m4wp-r357-4q94
Issue Tracking, Patch, Third Party Advisory x_refsource_misc
https://github.com/nextcloud/groupfolders/issues/1692
Patch, Third Party Advisory x_refsource_misc
https://github.com/nextcloud/server/pull/29362
Third Party Advisory vendor-advisory x_refsource_gentoo
https://security.gentoo.org/glsa/202208-17

Scores

CVSS v3 4.3
EPSS 0.0023
EPSS Percentile 46.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-862 CWE-863
Status published
Products (2)
nextcloud/nextcloud_server 22.2.0
nextcloud/nextcloud_server < 20.0.14
Published Mar 08, 2022
Tracked Since Feb 18, 2026