High severity8.1NVD Advisory· Published Sep 7, 2021· Updated Jun 17, 2026
CVE-2021-32800
CVE-2021-32800
Description
Nextcloud server is an open source, self hosted personal cloud. In affected versions an attacker is able to bypass Two Factor Authentication in Nextcloud. Thus knowledge of a password, or access to a WebAuthN trusted device of a user was sufficient to gain access to an account. It is recommended that the Nextcloud Server is upgraded to 20.0.12, 21.0.4 or 22.1.0. There are no workaround for this vulnerability.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
9- osv-coords6 versionspkg:rpm/opensuse/nextcloud&distro=openSUSE%20Leap%2015.2pkg:rpm/opensuse/nextcloud&distro=openSUSE%20Leap%2015.3pkg:rpm/suse/nextcloud&distro=SUSE%20Package%20Hub%2012pkg:rpm/suse/nextcloud&distro=SUSE%20Package%20Hub%2015%20SP1pkg:rpm/suse/nextcloud&distro=SUSE%20Package%20Hub%2015%20SP2pkg:rpm/suse/nextcloud&distro=SUSE%20Package%20Hub%2015%20SP3
< 20.0.12-lp152.3.12.1+ 5 more
- (no CPE)range: < 20.0.12-lp152.3.12.1
- (no CPE)range: < 20.0.12-bp153.2.6.1
- (no CPE)range: < 20.0.12-31.1
- (no CPE)range: < 20.0.12-bp151.3.18.1
- (no CPE)range: < 20.0.12-bp152.2.12.1
- (no CPE)range: < 20.0.12-bp153.2.6.1
- nextcloud/security-advisoriesv5Range: < 20.0.12
Patches
Vulnerability mechanics
References
4- github.com/nextcloud/server/pull/28078nvdPatchThird Party Advisory
- github.com/nextcloud/security-advisories/security/advisories/GHSA-gv5w-8q25-785vnvdThird Party Advisory
- hackerone.com/reports/1271052nvdPermissions RequiredThird Party Advisory
- security.gentoo.org/glsa/202208-17nvdThird Party Advisory
News mentions
0No linked articles in our index yet.