CVE-2021-22913

6.5 mediumEPSS 1.4%

Medium (6.5) in nextcloud deck. EPSS 1.4% chance of exploitation in the next 30 days.

Nextcloud Deck before 1.2.7, 1.4.1 suffers from an information disclosure vulnerability when searches for sharees utilize the lookup server by default instead of only the local Nextcloud server unless a global search has been explicitly chosen by the user.

Severity

CVSS 3.1

6.5 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

EPSS: 1.4% chance of exploitation in the next 30 days; higher than 71% of CVEs (scores of 2026-10-31)
CWE: CWE-200
Published: 2021-06-11
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

nextcloud:deck

References

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-h8f6-wg82-6p7r
https://hackerone.com/reports/1167958
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-h8f6-wg82-6p7r
https://hackerone.com/reports/1167958

Check your stack JSON