Every CVE Search/ Get API key

CVE-2021-41241

Advanced permissions is not respected for subfolders in Nextcloud server

4.3 Medium

Nextcloud server is a self hosted system designed to provide cloud style services. The groupfolders application for Nextcloud allows sharing a folder with a group of people. In addition, it allows setting "advanced permissions" on subfolders, for example, a user could be granted access to the groupfolder but not specific subfolders. Due to a lacking permission check in affected versions, a user could still access these subfolders by copying the groupfolder to another location. It is recommended that the Nextcloud Server is upgraded to 20.0.14, 21.0.6 or 22.2.1. Users unable to upgrade should disable the "groupfolders" application in the admin settings.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
None
Availability
None

Exploit likelihood

0.85%Unchanged since Mar 9, 2022
90%50%10%1%

What each source reports

CVE List Score used 4.3

Advanced permissions is not respected for subfolders in Nextcloud server

Nextcloud server is a self hosted system designed to provide cloud style services. The groupfolders application for Nextcloud allows sharing a folder with a group of people. In addition, it allows setting "advanced permissions" on subfolders, for example, a user could be granted access to the groupfolder but not specific subfolders. Due to a lacking permission check in affected versions, a user could still access these subfolders by copying the groupfolder to another location. It is recommended that the Nextcloud Server is upgraded to 20.0.14, 21.0.6 or 22.2.1. Users unable to upgrade should disable the "groupfolders" application in the admin settings.

Record
CVE-2021-41241
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-863
Updated
2026-11-02
EUVDEUVD-2021-28295 4.3

Nextcloud server is a self hosted system designed to provide cloud style services. The groupfolders application for Nextcloud allows sharing a folder with a group of people. In addition, it allows setting "advanced permissions" on subfolders, for example, a user could be granted access to the groupfolder but not specific subfolders. Due to a lacking permission check in affected versions, a user could still access these subfolders by copying the groupfolder to another location. It is recommended that the Nextcloud Server is upgraded to 20.0.14, 21.0.6 or 22.2.1. Users unable to upgrade should disable the "groupfolders" application in the admin settings.

Record
EUVD-2021-28295
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-02
NVD 4.3

Nextcloud server is a self hosted system designed to provide cloud style services. The groupfolders application for Nextcloud allows sharing a folder with a group of people. In addition, it allows setting "advanced permissions" on subfolders, for example, a user could be granted access to the groupfolder but not specific subfolders. Due to a lacking permission check in affected versions, a user could still access these subfolders by copying the groupfolder to another location. It is recommended that the Nextcloud Server is upgraded to 20.0.14, 21.0.6 or 22.2.1. Users unable to upgrade should disable the "groupfolders" application in the admin settings.

Record
CVE-2021-41241
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS 2.0
4.0 MediumAV:N/AC:L/Au:S/C:P/I:N/A:N
Weakness
CWE-863, CWE-862
Updated
2026-11-02
OSV 4.3

Nextcloud server is a self hosted system designed to provide cloud style services. The groupfolders application for Nextcloud allows sharing a folder with a group of people. In addition, it allows setting "advanced permissions" on subfolders, for example, a user could be granted access to the groupfolder but not specific subfolders. Due to a lacking permission check in affected versions, a user could still access these subfolders by copying the groupfolder to another location. It is recommended that the Nextcloud Server is upgraded to 20.0.14, 21.0.6 or 22.2.1. Users unable to upgrade should disable the "groupfolders" application in the admin settings.

Record
CVE-2021-41241
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-02
OSVopenSUSE-SU-2022:0089-1 No score

Security update for nextcloud

This update for nextcloud fixes the following issues:

nextcloud was updated to 21.0.9:

  • CVE-2021-41239 (CWE-200): user enumeration setting not obeyed in User Status API (boo#1196905)
  • CVE-2021-41241 (CWE-863): groupfolders advanced permissions is not obeyed for subfolders (boo#1196908)
  • CVE-2021-41741 (CWE-400): High memory usage for generating preview of broken image (boo#1196952)
  • For more changes see https://nextcloud.com/changelog/#21-0-9
Record
openSUSE-SU-2022:0089-1
Updated
2026-11-02
OSVopenSUSE-SU-2022:0098-1 No score

Security update for nextcloud

This update for nextcloud fixes the following issues:

nextcloud was updated to 21.0.9:

  • CVE-2021-41239 (CWE-200): user enumeration setting not obeyed in User Status API (boo#1196905)
  • CVE-2021-41241 (CWE-863): groupfolders advanced permissions is not obeyed for subfolders (boo#1196908)
  • CVE-2021-41741 (CWE-400): High memory usage for generating preview of broken image (boo#1196952)
  • For more changes see https://nextcloud.com/changelog/#21-0-9
Record
openSUSE-SU-2022:0098-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
nextcloud
SUSE:Package Hub 12
From an advisory covering 3 CVEs
 before 21.0.9-37.1
21.0.9-37.1
nextcloud
SUSE:Package Hub 15 SP3
From an advisory covering 3 CVEs
 before 21.0.9-bp153.2.12.1
21.0.9-bp153.2.12.1
nextcloud
openSUSE:Leap 15.3
From an advisory covering 3 CVEs
 before 21.0.9-bp153.2.12.1
21.0.9-bp153.2.12.1

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-41241 is a medium vulnerability (CVSS 4.3) in Nextcloud Server, published March 8, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.85%, the 58th percentile. No source names a fixed version.

References

Show 6 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open