{"api_version":"1","generated_at":"2026-07-24T00:33:18+00:00","cve":"CVE-2021-32654","urls":{"html":"https://cve.report/CVE-2021-32654","api":"https://cve.report/api/cve/CVE-2021-32654.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2021-32654","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2021-32654"},"summary":{"title":"CVE-2021-32654","description":"Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.11, 20.0.10, and 21.0.2, an attacker is able to receive write/read privileges on any Federated File Share. Since public links can be added as federated file share, this can also be exploited on any public link. Users can upgrade to patched versions (19.0.11, 20.0.10 or 21.0.2) or, as a workaround, disable federated file sharing.","state":"PUBLIC","assigner":"security-advisories@github.com","published_at":"2021-06-01 21:15:00","updated_at":"2022-10-26 14:09:00"},"problem_types":["CWE-639"],"metrics":[],"references":[{"url":"https://hackerone.com/reports/1170024","name":"https://hackerone.com/reports/1170024","refsource":"MISC","tags":[],"title":"HackerOne","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://security.gentoo.org/glsa/202208-17","name":"GLSA-202208-17","refsource":"GENTOO","tags":[],"title":"Nextcloud: Multiple Vulnerabilities (GLSA 202208-17) — Gentoo security","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://github.com/nextcloud/security-advisories/security/advisories/GHSA-jf9h-v24c-22g5","name":"https://github.com/nextcloud/security-advisories/security/advisories/GHSA-jf9h-v24c-22g5","refsource":"CONFIRM","tags":[],"title":"Attacker can obtain write access to any federated share/public link · Advisory · nextcloud/security-advisories · GitHub","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-32654","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-32654","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2021","cve_id":"32654","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"nextcloud","cpe5":"nextcloud_server","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[{"cve":"CVE-2021-32654","qid":"710590","title":"Gentoo Linux Nextcloud Multiple Vulnerabilities (GLSA 202208-17)"}]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"security-advisories@github.com","ID":"CVE-2021-32654","STATE":"PUBLIC","TITLE":"Attacker can obtain write access to any federated share/public link"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"security-advisories","version":{"version_data":[{"version_value":"< 19.0.11"},{"version_value":">= 20.0.0, < 20.0.10"},{"version_value":">= 21.0.0, < 21.0.2"}]}}]},"vendor_name":"nextcloud"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.11, 20.0.10, and 21.0.2, an attacker is able to receive write/read privileges on any Federated File Share. Since public links can be added as federated file share, this can also be exploited on any public link. Users can upgrade to patched versions (19.0.11, 20.0.10 or 21.0.2) or, as a workaround, disable federated file sharing."}]},"impact":{"cvss":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"CWE-639: Authorization Bypass Through User-Controlled Key"}]}]},"references":{"reference_data":[{"name":"https://github.com/nextcloud/security-advisories/security/advisories/GHSA-jf9h-v24c-22g5","refsource":"CONFIRM","url":"https://github.com/nextcloud/security-advisories/security/advisories/GHSA-jf9h-v24c-22g5"},{"name":"https://hackerone.com/reports/1170024","refsource":"MISC","url":"https://hackerone.com/reports/1170024"},{"refsource":"GENTOO","name":"GLSA-202208-17","url":"https://security.gentoo.org/glsa/202208-17"}]},"source":{"advisory":"GHSA-jf9h-v24c-22g5","discovery":"UNKNOWN"}},"nvd":{"publishedDate":"2021-06-01 21:15:00","lastModifiedDate":"2022-10-26 14:09:00","problem_types":["CWE-639"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE","baseScore":9.1,"baseSeverity":"CRITICAL"},"exploitabilityScore":3.9,"impactScore":5.2},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:N","accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"NONE","baseScore":6.4},"severity":"MEDIUM","exploitabilityScore":10,"impactScore":4.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:*:*:*:*","versionEndExcluding":"19.0.11","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:*:*:*:*","versionStartIncluding":"20.0.0","versionEndExcluding":"20.0.10","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:*:*:*:*","versionStartIncluding":"21.0.0","versionEndExcluding":"21.0.2","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2021","CveId":"32654","Ordinal":"208042","Title":"CVE-2021-32654","CVE":"CVE-2021-32654","Year":"2021"},"notes":[{"CveYear":"2021","CveId":"32654","Ordinal":"1","NoteData":"Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.11, 20.0.10, and 21.0.2, an attacker is able to receive write/read privileges on any Federated File Share. Since public links can be added as federated file share, this can also be exploited on any public link. Users can upgrade to patched versions (19.0.11, 20.0.10 or 21.0.2) or, as a workaround, disable federated file sharing.","Type":"Description","Title":null},{"CveYear":"2021","CveId":"32654","Ordinal":"2","NoteData":"2021-06-01","Type":"Other","Title":"Published"},{"CveYear":"2021","CveId":"32654","Ordinal":"3","NoteData":"2021-06-01","Type":"Other","Title":"Modified"}]}}}