CVE-2021-20874

7.5 highEPSS 1.3%

High (7.5) in groupsession groupsession. EPSS 1.3% chance of exploitation in the next 30 days.

Incorrect permission assignment for critical resource vulnerability in GroupSession Free edition ver5.1.1 and earlier, GroupSession byCloud ver5.1.1 and earlier, and GroupSession ZION ver5.1.1 and earlier allows a remote unauthenticated attacker to access arbitrary files on the server and obtain sensitive information via unspecified vectors.

Severity

CVSS 3.1

7.5 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS: 1.3% chance of exploitation in the next 30 days; higher than 71% of CVEs (scores of 2026-10-31)
CWE: CWE-732
Published: 2021-12-24
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

groupsession:groupsession

References

https://groupsession.jp/info/info-news/security20211220
https://jvn.jp/en/jp/JVN79798166/index.html
https://groupsession.jp/info/info-news/security20211220
https://jvn.jp/en/jp/JVN79798166/index.html

Check your stack JSON