CVE-2021-22912

6.5 mediumEPSS 1.4%

Medium (6.5) in nextcloud nextcloud. EPSS 1.4% chance of exploitation in the next 30 days.

Nextcloud iOS before 3.4.2 suffers from an information disclosure vulnerability when searches for sharees utilize the lookup server by default instead of only on the local Nextcloud server unless a global search has been explicitly chosen by the user.

Severity

CVSS 3.1

6.5 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

EPSS: 1.4% chance of exploitation in the next 30 days; higher than 71% of CVEs (scores of 2026-10-31)
CWE: CWE-200
Published: 2021-06-11
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

nextcloud:nextcloud

References

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-m7w4-cvjr-76mh
https://hackerone.com/reports/1167919
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-m7w4-cvjr-76mh
https://hackerone.com/reports/1167919

Check your stack JSON