CVE-2021-22905

6.5 mediumEPSS 1.4%

Medium (6.5) in nextcloud nextcloud. EPSS 1.4% chance of exploitation in the next 30 days.

Nextcloud Android App (com.nextcloud.client) before v3.16.0 is vulnerable to information disclosure due to searches for sharees being performed by default on the lookup server instead of only using the local Nextcloud server unless a global search has been explicitly chosen by the user.

Severity

CVSS 3.1

6.5 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

EPSS: 1.4% chance of exploitation in the next 30 days; higher than 72% of CVEs (scores of 2026-10-31)
CWE: CWE-200
Published: 2021-06-11
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

nextcloud:nextcloud

References

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-22v9-q3r6-x7cj
https://hackerone.com/reports/1167916
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-22v9-q3r6-x7cj
https://hackerone.com/reports/1167916

Check your stack JSON