Read the docs
TI-2021-18018 Aliases CVE-2021-41179

Two-Factor Authentication not enforced for pages marked as public

Priority LOW 31CWE-304Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Nextcloud is an open-source, self-hosted productivity platform. Prior to Nextcloud Server versions 20.0.13, 21.0.5, and 22.2.0, the Two-Factor Authentication wasn't enforced for pages marked as public. Any page marked as `@PublicPage` could thus be accessed with a valid user session that isn't authenticated. This particularly affects the Nextcloud Talk application, as this could be leveraged to gain access to any private chat channel without going through the Two-Factor flow. It is recommended that the Nextcloud Server be upgraded to 20.0.13, 21.0.5 or 22.2.0. There are no known workarounds aside from upgrading.

Why it matters now

EPSS 0.01195 68th percentileScored 2026-11-07
Fix Fixed security-advisories (nextcloud): 20.0.13, 21.0.5, 22.2.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
nextcloudsecurity-advisoriesbefore 20.0.13; 21.0.0 to before 21.0.5; before 22.2.020.0.13, 21.0.5, 22.2.0Patch availableCNA
  • security-advisories Vendornextcloud Affected before 20.0.13; 21.0.0 to before 21.0.5; before 22.2.0 Fixed in 20.0.13, 21.0.5, 22.2.0 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:nextcloud:server:*:*:*:*:*:*:*:*20.0.3 to before 20.0.13; 21.0.1 to before 21.0.5; 22.1.1 to before 22.2.0Vulnerablenextcloud
  • cpe:2.3:a:nextcloud:server:*:*:*:*:*:*:*:* Versions 20.0.3 to before 20.0.13; 21.0.1 to before 21.0.5; 22.1.1 to before 22.2.0 Vulnerable ·nextcloud

Remediation

  • Fix · CNA security-advisories (nextcloud) Fixed in 20.0.13, 21.0.5, 22.2.0

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-41179

References

Patch 1

Advisory 1

Other 1

  • TI-2021-18017 File Traversal affecting SVG files on Nextcloud Server CVSS 3.1HIGH 8.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences