Secret Circle can be joined without approval in Nextcloud Circles
Priority LOW 31CWE-639Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-639.
Summary
Nextcloud Circles is an open source social network built for the nextcloud ecosystem. In affected versions the Nextcloud Circles application allowed any user to join any "Secret Circle" without approval by the Circle owner leaking private information. It is recommended that Nextcloud Circles is upgraded to 0.19.15, 0.20.11 or 0.21.4. There are no workarounds for this issue.
Why it matters now
EPSS 0.01202 68th percentileScored 2026-11-07
Fix Fixed security-advisories (nextcloud): 0.19.15, 0.20.11, 0.21.4
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| nextcloud | security-advisories | before 0.19.15; 0.20.0 to before 0.20.11; 0.21.0 to before 0.21.4 | 0.19.15, 0.20.11, 0.21.4 | Patch available | CNA |
- security-advisories Vendornextcloud Affected before 0.19.15; 0.20.0 to before 0.20.11; 0.21.0 to before 0.21.4 Fixed in 0.19.15, 0.20.11, 0.21.4 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:nextcloud:circles:*:*:*:*:*:*:*:* | before 0.19.5; 0.20.0 to before 0.20.11; 0.21.0 to before 0.21.4 | Vulnerable | nextcloud |
- cpe:2.3:a:nextcloud:circles:*:*:*:*:*:*:*:* Versions before 0.19.5; 0.20.0 to before 0.20.11; 0.21.0 to before 0.21.4 Vulnerable ·nextcloud
Remediation
- Fix · CNA security-advisories (nextcloud) Fixed in 0.19.15, 0.20.11, 0.21.4
Timeline
- 2026-10-02 Threatist record created from CVE-2021-37630
References
More nextcloud Circles vulnerabilities
- TI-2021-12449 Cross-Site Scripting in Nextcloud Circles CVSS 3.1MEDIUM 5.8
- TI-2019-11709 Improper authorization in Nextcloud Circles CVSS 3.1MEDIUM 4.3
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences