CVE-2021-32653

2.7 lowEPSS 1.2%

Low (2.7) in nextcloud nextcloud server. EPSS 1.2% chance of exploitation in the next 30 days.

Nextcloud Server is a Nextcloud package that handles data storage. Nextcloud Server versions prior to 19.0.11, 20.0.10, or 21.0.2 send user IDs to the lookup server even if the user has no fields set to published. The vulnerability is patched in versions 19.0.11, 20.0.10, and 21.0.2; no workarounds outside the updates are known to exist.

Severity

CVSS 3.1

2.7 low

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

EPSS: 1.2% chance of exploitation in the next 30 days; higher than 68% of CVEs (scores of 2026-10-31)
CWE: CWE-201
Published: 2021-06-01
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

nextcloud:nextcloud_server

References

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-396j-vqpr-qg45
https://hackerone.com/reports/1173436
https://security.gentoo.org/glsa/202208-17
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-396j-vqpr-qg45
https://hackerone.com/reports/1173436

Check your stack JSON