Read the docs
TI-2021-12356 Aliases CVE-2021-32688

Application specific tokens can change their own scope

Priority MEDIUM 42CWE-285Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass, Information disclosure
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-285 and CWE-552.

Summary

Nextcloud Server is a Nextcloud package that handles data storage. Nextcloud Server supports application specific tokens for authentication purposes. These tokens are supposed to be granted to a specific applications (e.g. DAV sync clients), and can also be configured by the user to not have any filesystem access. Due to a lacking permission check, the tokens were able to change their own permissions in versions prior to 19.0.13, 20.0.11, and 21.0.3. Thus fileystem limited tokens were able to grant themselves access to the filesystem. The issue is patched in versions 19.0.13, 20.0.11, and 21.0.3. There are no known workarounds aside from upgrading.

Why it matters now

EPSS 0.02309 83rd percentileScored 2026-11-07
Fix Fixed security-advisories (nextcloud): 19.0.13, 20.0.11, 21.0.3

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
nextcloudsecurity-advisoriesbefore 19.0.13; 20.0.0 to before 20.0.11; 21.0.0 to before 21.0.319.0.13, 20.0.11, 21.0.3Patch availableCNA
  • security-advisories Vendornextcloud Affected before 19.0.13; 20.0.0 to before 20.0.11; 21.0.0 to before 21.0.3 Fixed in 19.0.13, 20.0.11, 21.0.3 Patch available CNA

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:*:*:*:*before 19.0.13; 20.0.0 to before 20.0.11; 21.0.0 to before 21.0.3Vulnerablenextcloud
cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*33VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*34VulnerableFedoraproject
  • cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:*:*:*:* Versions before 19.0.13; 20.0.0 to before 20.0.11; 21.0.0 to before 21.0.3 Vulnerable ·nextcloud
  • cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* Versions 33 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* Versions 34 Vulnerable ·Fedoraproject

Remediation

  • Fix · CNA security-advisories (nextcloud) Fixed in 19.0.13, 20.0.11, 21.0.3

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    nextcloud security-advisories — FEDORA-2021-6f327296fe

    6 records Highest priority Priority MEDIUM 2 MEDIUM, 4 LOW

    Other records, highest priority first

    • TI-2021-12347 Filenames not escaped by default in controllers using DownloadResponsePriority MEDIUM 41
    • TI-2021-12373 Lack of ratelimit on public DAV endpointPriority LOW 36
    • TI-2021-12371 Lack of ratelimit on shareinfo endpointPriority LOW 27
    Show all 6 records → Advisory →
  • Advisory ·

    nextcloud security-advisories — FEDORA-2021-9b421b78af

    6 records Highest priority Priority MEDIUM 2 MEDIUM, 4 LOW

    Other records, highest priority first

    • TI-2021-12347 Filenames not escaped by default in controllers using DownloadResponsePriority MEDIUM 41
    • TI-2021-12373 Lack of ratelimit on public DAV endpointPriority LOW 36
    • TI-2021-12371 Lack of ratelimit on shareinfo endpointPriority LOW 27
    Show all 6 records → Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-32688

References

Patch 1

Advisory 4

Other 1

  • TI-2023-20855 Users can delete external storage mount points CVSS 3.1HIGH 7.7
  • TI-2023-11091 Nextcloud download permissions can be changed by resharer CVSS 3.1HIGH 7.5
  • TI-2023-10624 Nextcloud Server vulnerable to SSRF via filter bypass due to lax checking on IPs CVSS 3.1MEDIUM 5.3
  • TI-2025-37238 Cross-site scripting in Nextcloud CVSS 3.1MEDIUM 6.4
  • TI-2023-11086 nextcloud vulnerable to Uncontrolled Resource Consumption CVSS 3.1MEDIUM 6.5
  • TI-2022-18738 Exception logging in Sharepoint app reveals clear-text connection details CVSS 3.1MEDIUM 6.5
See all 188 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences