CVE-2021-32689: nextcloud security-advisories
Vulnerability summary
CVE-2021-32689 is a high (CVSS 8.1) vulnerability in nextcloud security-advisories. EPSS estimates a 1.00% chance of exploitation in the next 30 days, higher than 62.1% of scored vulnerabilities.
Timeline
- 12-07-2021PublishedVulnerability first disclosed.
- 03-08-2024Last modifiedVulnerability information updated.
Description
Nextcloud Talk is a fully on-premises audio/video and chat communication service. In versions prior to 11.2.2, if a user was able to reuse an earlier used username, they could get access to any chat message sent to the previous user with this username. The issue was patched in versions 11.2.2 and 11.3.0. As a workaround, don't allow users to choose usernames themselves. This is the default behaviour of Nextcloud, but some user providers may allow doing so.
CVSS metrics
3 scores · 2 sources · 2 versions- NVDNIST6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NDiffers
EPSS trend
Probability
1.00%
Chance of exploitation in the next 30 days
Percentile
62%
Versus all other CVEs
30-day change
0.00 pp
From 1.00% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-200Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
- CWE-708Incorrect Ownership AssignmentThe product assigns an owner to a resource, but the owner is outside of the intended control sphere.
Affected systems
Nextcloud2 products
- security-advisories< 11.2.2
- talk< 11.2.2
1 vendor · 2 products
References
5 links- github.com/nextcloud/security-advisories/security/advisories/GHSA-xv6f-344w-895cX Refsource CONFIRMThird Party Advisory