Read the docs
TI-2021-18090 Aliases CVE-2021-41256

Intent URI permissions manipulation in nextcloud news-android

Priority LOW 33CWE-829Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-829.

Summary

nextcloud news-android is an Android client for the Nextcloud news/feed reader app. In affected versions the Nextcloud News for Android app has a security issue by which a malicious application installed on the same device can send it an arbitrary Intent that gets reflected back, unintentionally giving read and write access to non-exported Content Providers in Nextcloud News for Android. Users should upgrade to version 0.9.9.63 or higher as soon as possible.

Why it matters now

EPSS 0.01113 66th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed news-android (nextcloud): 0.9.9.63

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
nextcloudnews-androidbefore 0.9.9.630.9.9.63Patch availableCNA
  • news-android Vendornextcloud Affected before 0.9.9.63 Fixed in 0.9.9.63 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:nextcloud:news:*:*:*:*:*:android:*:*before 0.9.9.63Vulnerablenextcloud
  • cpe:2.3:a:nextcloud:news:*:*:*:*:*:android:*:* Versions before 0.9.9.63 Vulnerable ·nextcloud

Remediation

  • Fix · CNA news-android (nextcloud) Fixed in 0.9.9.63

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-41256

References

Exploit 1

Patch 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences