{"id":"CVE-2021-32800","aliases":["EUVD-2021-19560","GHSA-gv5w-8q25-785v","openSUSE-SU-2021:1250-1","openSUSE-SU-2021:1252-1","openSUSE-SU-2021:1253-1","openSUSE-SU-2021:1255-1","openSUSE-SU-2021:1275-1"],"status":"published","title":"Bypass of Two Factor Authentication in Nextcloud server","description":"Nextcloud server is an open source, self hosted personal cloud. In affected versions an attacker is able to bypass Two Factor Authentication in Nextcloud. Thus knowledge of a password, or access to a WebAuthN trusted device of a user was sufficient to gain access to an account. It is recommended that the Nextcloud Server is upgraded to 20.0.12, 21.0.4 or 22.1.0. There are no workaround for this vulnerability.","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.01798,"percentile":0.78751,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-306"],"published":"2021-09-07T21:35:11Z","modified":"2026-10-20T10:54:43Z","affected":[{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP1","package":"nextcloud","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.0.12-bp151.3.18.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Package Hub 12","package":"nextcloud","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.0.12-31.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"nextcloud","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.0.12-lp152.3.12.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP3","package":"nextcloud","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.0.12-bp153.2.6.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"nextcloud","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.0.12-bp153.2.6.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP2","package":"nextcloud","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.0.12-bp152.2.12.1"}]}],"bundled":4}],"products":[{"vendor":"kiteworks","product":"security-advisories"},{"vendor":"nextcloud","product":"nextcloud_server"},{"vendor":"nextcloud","product":"security-advisories"}],"references":[{"url":"https://github.com/nextcloud/security-advisories/security/advisories/GHSA-gv5w-8q25-785v","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://github.com/nextcloud/server/pull/28078","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://hackerone.com/reports/1271052","tags":["x_refsource_MISC","x_transferred","Permissions Required","Third Party Advisory","report"]},{"url":"https://security.gentoo.org/glsa/202208-17","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/KB2IJ2VSI6P5WFS6XKMPAPGT6545U4WN/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1190291","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-32766","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-32800","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-32801","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-32802","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/5PSLXDEBLEPENTY4PS62BFVL7QHFQ2RC/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/KTAQAEILOXFUPY3SZFAMY4NQGD5OXQX3/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/FGLFYZROCOIJAG7C45FNC4EUIMNFJRIL/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/4MPG3PDTQCC4GNWH7SOI44CK2TZJDN5R/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2021-32800","title":"Bypass of Two Factor Authentication in Nextcloud server","description":"Nextcloud server is an open source, self hosted personal cloud. In affected versions an attacker is able to bypass Two Factor Authentication in Nextcloud. Thus knowledge of a password, or access to a WebAuthN trusted device of a user was sufficient to gain access to an account. It is recommended that the Nextcloud Server is upgraded to 20.0.12, 21.0.4 or 22.1.0. There are no workaround for this vulnerability.","status":"published","published":"2021-09-07T21:35:11Z","modified":"2024-08-03T23:33:56.162Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-306"],"updated_at":"2026-11-02T14:33:07.349244Z"}],"euvd":[{"id":"EUVD-2021-19560","description":"Nextcloud server is an open source, self hosted personal cloud. In affected versions an attacker is able to bypass Two Factor Authentication in Nextcloud. Thus knowledge of a password, or access to a WebAuthN trusted device of a user was sufficient to gain access to an account. It is recommended that the Nextcloud Server is upgraded to 20.0.12, 21.0.4 or 22.1.0. There are no workaround for this vulnerability.","status":"published","published":"2021-09-07T21:35:11Z","modified":"2024-08-03T23:33:56Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-03T03:24:35.30045Z"}],"nvd":[{"id":"CVE-2021-32800","description":"Nextcloud server is an open source, self hosted personal cloud. In affected versions an attacker is able to bypass Two Factor Authentication in Nextcloud. Thus knowledge of a password, or access to a WebAuthN trusted device of a user was sufficient to gain access to an account. It is recommended that the Nextcloud Server is upgraded to 20.0.12, 21.0.4 or 22.1.0. There are no workaround for this vulnerability.","status":"published","published":"2021-09-07T22:15:08.417Z","modified":"2026-06-17T03:53:39.223Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"secondary"},{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":6.4,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-306"],"updated_at":"2026-11-02T14:06:58.05696Z"}],"osv":[{"id":"CVE-2021-32800","description":"Nextcloud server is an open source, self hosted personal cloud. In affected versions an attacker is able to bypass Two Factor Authentication in Nextcloud. Thus knowledge of a password, or access to a WebAuthN trusted device of a user was sufficient to gain access to an account. It is recommended that the Nextcloud Server is upgraded to 20.0.12, 21.0.4 or 22.1.0. There are no workaround for this vulnerability.","status":"published","published":"2021-09-07T22:15:08.417Z","modified":"2026-10-20T10:54:43.163600599Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:19.793849Z"},{"id":"openSUSE-SU-2021:1250-1","title":"Security update for nextcloud","description":"This update for nextcloud fixes the following issues:\n\nUpdate to 20.0.12\n\nFix boo#1190291:\n\n- CVE-2021-32766 (CWE-209): Generation of Error Message Containing Sensitive Information \n- CVE-2021-32800 (CWE-306): Missing Authentication for Critical Function \n- CVE-2021-32801 (CWE-532): Insertion of Sensitive Information into Log File \n- CVE-2021-32802 (CWE-829): Inclusion of Functionality from Untrusted Control Sphere \n\nChanges\n\n- Bump vue-router from 3.4.3 to 3.4.9 (server#27224)\n- Bump v-click-outside from 3.1.1 to 3.1.2 (server#27232)\n- Bump url-search-params-polyfill from 8.1.0 to 8.1.1 (server#27236)\n- Bump debounce from 1.2.0 to 1.2.1 (server#27646)\n- Bump vue and vue-template-compiler (server#27701)\n- Design fixes to app-settings button (server#27745)\n- Reset checksum when writing files to object store (server#27754)\n- Run s3 tests again (server#27804)\n- Fix in locking cache check (server#27829)\n- Bump dompurify from 2.2.8 to 2.2.9 (server#27836)\n- Make search popup usable on mobile, too (server#27858)\n- Cache images on browser (server#27863)\n- Fix dark theme on public link shares (server#27895)\n- Make user status usable on mobile (server#27897)\n- Do not escape display name in dashboard welcome text (server#27913)\n- Bump moment-timezone from 0.5.31 to 0.5.33 (server#27924)\n- Fix newfileMenu on public page (server#27941)\n- Fix svg icons disapearing in app navigation when text overflows (server#27955)\n- Bump bootstrap from 4.5.2 to 4.5.3 (server#27965)\n- Show registered breadcrumb detail views in breadcrumb menu (server#27970)\n- Fix regression in file sidebar (server#27976)\n- Bump exports-loader from 1.1.0 to 1.1.1 (server#27984)\n- Bump @nextcloud/capabilities from 1.0.2 to 1.0.4 (server#27985)\n- Bump @nextcloud/vue-dashboard from 1.0.0 to 1.0.1 (server#27988)\n- Improve notcreatable permissions hint (server#28006)\n- Update CRL due to revoked twofactor_nextcloud_notification.crt (server#28018)\n- Bump sass-loader from 10.0.2 to 10.0.5 (server#28032)\n- Increase footer height for longer menus (server#28045)\n- Mask password for Redis and RedisCluster on connection failure (server#28054)\n- Fix missing theming for login button (server#28065)\n- Fix overlapping of elements in certain views (server#28072)\n- Disable HEIC image preview provider for performance concerns (server#28081)\n- Improve provider check (server#28087)\n- Sanitize more functions from the encryption app (server#28091)\n- Hide download button for public preview of audio files (server#28096)\n- L10n: HTTP in capital letters (server#28107)\n- Fix dark theme in file exists dialog (server#28111)\n- Let memory limit set in tests fit the used amount (server#28125)\n- User management - Add icon to user groups (server#28172)\n- Bump marked from 1.1.1 to 1.1.2 (server#28187)\n- Fix variable override in file view (server#28191)\n- Bump regenerator-runtime from 0.13.7 to 0.13.9 (server#28207)\n- Bump url-loader from 4.1.0 to 4.1.1 (server#28208)\n- Fix Files breadcrumbs being hidden even if there is enough space (server#28224)\n- Dont apply jail search filter is on the root (server#28241)\n- Check that php was compiled with argon2 support or that the php-sodium extensions is installed (server#28289)\n- Fix preference name when generating notifications (activity#603)\n- Fix monochrome icon detection for correct dark mode invert (activity#607)\n- Fix 'Enable notification emails' (activity#613)\n- Show add, del and restored files within by and self filter (activity#616)\n- Link from app-navigation-settings to personal settings (activity#625)\n- Fix pdfviewer design (files_pdfviewer#446)\n- Include version number in firstrunwizard (firstrunwizard#570)\n- Use notification main link if no parameter has a link (notifications#1040)\n- Bump sass-loader from 10.1.0 to 10.1.1 (text#1360)\n- Bump @babel/plugin-transform-runtime from 7.13.9 to 7.13.15 (text#1548)\n- Bump @babel/preset-env from 7.13.9 to 7.13.15 (text#1550)\n- Bump vue-loader from 15.9.6 to 15.9.7 (text#1592)\n- Unify error responses and add logging where appropriate (text#1719)\n- Disable header timeout on mobile (viewer#978)\n","status":"published","published":"2021-09-13T14:06:26Z","modified":"2026-02-04T02:55:11.122071Z","updated_at":"2026-11-02T16:58:32.266854Z"},{"id":"openSUSE-SU-2021:1252-1","title":"Security update for nextcloud","description":"This update for nextcloud fixes the following issues:\n\nUpdate to 20.0.12\n\nFixed security issues (boo#1190291):\n\n- CVE-2021-32766 (CWE-209): Generation of Error Message Containing Sensitive Information \n- CVE-2021-32800 (CWE-306): Missing Authentication for Critical Function \n- CVE-2021-32801 (CWE-532): Insertion of Sensitive Information into Log File \n- CVE-2021-32802 (CWE-829): Inclusion of Functionality from Untrusted Control Sphere \n\nChanges\n\n- Bump vue-router from 3.4.3 to 3.4.9 (server#27224)\n- Bump v-click-outside from 3.1.1 to 3.1.2 (server#27232)\n- Bump url-search-params-polyfill from 8.1.0 to 8.1.1 (server#27236)\n- Bump debounce from 1.2.0 to 1.2.1 (server#27646)\n- Bump vue and vue-template-compiler (server#27701)\n- Design fixes to app-settings button (server#27745)\n- Reset checksum when writing files to object store (server#27754)\n- Run s3 tests again (server#27804)\n- Fix in locking cache check (server#27829)\n- Bump dompurify from 2.2.8 to 2.2.9 (server#27836)\n- Make search popup usable on mobile, too (server#27858)\n- Cache images on browser (server#27863)\n- Fix dark theme on public link shares (server#27895)\n- Make user status usable on mobile (server#27897)\n- Do not escape display name in dashboard welcome text (server#27913)\n- Bump moment-timezone from 0.5.31 to 0.5.33 (server#27924)\n- Fix newfileMenu on public page (server#27941)\n- Fix svg icons disapearing in app navigation when text overflows (server#27955)\n- Bump bootstrap from 4.5.2 to 4.5.3 (server#27965)\n- Show registered breadcrumb detail views in breadcrumb menu (server#27970)\n- Fix regression in file sidebar (server#27976)\n- Bump exports-loader from 1.1.0 to 1.1.1 (server#27984)\n- Bump @nextcloud/capabilities from 1.0.2 to 1.0.4 (server#27985)\n- Bump @nextcloud/vue-dashboard from 1.0.0 to 1.0.1 (server#27988)\n- Improve notcreatable permissions hint (server#28006)\n- Update CRL due to revoked twofactor_nextcloud_notification.crt (server#28018)\n- Bump sass-loader from 10.0.2 to 10.0.5 (server#28032)\n- Increase footer height for longer menus (server#28045)\n- Mask password for Redis and RedisCluster on connection failure (server#28054)\n- Fix missing theming for login button (server#28065)\n- Fix overlapping of elements in certain views (server#28072)\n- Disable HEIC image preview provider for performance concerns (server#28081)\n- Improve provider check (server#28087)\n- Sanitize more functions from the encryption app (server#28091)\n- Hide download button for public preview of audio files (server#28096)\n- L10n: HTTP in capital letters (server#28107)\n- Fix dark theme in file exists dialog (server#28111)\n- Let memory limit set in tests fit the used amount (server#28125)\n- User management - Add icon to user groups (server#28172)\n- Bump marked from 1.1.1 to 1.1.2 (server#28187)\n- Fix variable override in file view (server#28191)\n- Bump regenerator-runtime from 0.13.7 to 0.13.9 (server#28207)\n- Bump url-loader from 4.1.0 to 4.1.1 (server#28208)\n- Fix Files breadcrumbs being hidden even if there is enough space (server#28224)\n- Dont apply jail search filter is on the root (server#28241)\n- Check that php was compiled with argon2 support or that the php-sodium extensions is installed (server#28289)\n- Fix preference name when generating notifications (activity#603)\n- Fix monochrome icon detection for correct dark mode invert (activity#607)\n- Fix 'Enable notification emails' (activity#613)\n- Show add, del and restored files within by and self filter (activity#616)\n- Link from app-navigation-settings to personal settings (activity#625)\n- Fix pdfviewer design (files_pdfviewer#446)\n- Include version number in firstrunwizard (firstrunwizard#570)\n- Use notification main link if no parameter has a link (notifications#1040)\n- Bump sass-loader from 10.1.0 to 10.1.1 (text#1360)\n- Bump @babel/plugin-transform-runtime from 7.13.9 to 7.13.15 (text#1548)\n- Bump @babel/preset-env from 7.13.9 to 7.13.15 (text#1550)\n- Bump vue-loader from 15.9.6 to 15.9.7 (text#1592)\n- Unify error responses and add logging where appropriate (text#1719)\n- Disable header timeout on mobile (viewer#978)\n","status":"published","published":"2021-09-14T09:33:54Z","modified":"2025-05-07T18:12:52.293412Z","updated_at":"2026-11-02T16:58:32.266854Z"},{"id":"openSUSE-SU-2021:1253-1","title":"Security update for nextcloud","description":"This update for nextcloud fixes the following issues:\n\nUpdate to 20.0.12\n\nFix boo#1190291 \n\n- CVE-2021-32766 (CWE-209): Generation of Error Message Containing Sensitive Information \n- CVE-2021-32800 (CWE-306): Missing Authentication for Critical Function \n- CVE-2021-32801 (CWE-532): Insertion of Sensitive Information into Log File \n- CVE-2021-32802 (CWE-829): Inclusion of Functionality from Untrusted Control Sphere \n\nChanges:\n\n- Bump vue-router from 3.4.3 to 3.4.9 (server#27224)\n- Bump v-click-outside from 3.1.1 to 3.1.2 (server#27232)\n- Bump url-search-params-polyfill from 8.1.0 to 8.1.1 (server#27236)\n- Bump debounce from 1.2.0 to 1.2.1 (server#27646)\n- Bump vue and vue-template-compiler (server#27701)\n- Design fixes to app-settings button (server#27745)\n- Reset checksum when writing files to object store (server#27754)\n- Run s3 tests again (server#27804)\n- Fix in locking cache check (server#27829)\n- Bump dompurify from 2.2.8 to 2.2.9 (server#27836)\n- Make search popup usable on mobile, too (server#27858)\n- Cache images on browser (server#27863)\n- Fix dark theme on public link shares (server#27895)\n- Make user status usable on mobile (server#27897)\n- Do not escape display name in dashboard welcome text (server#27913)\n- Bump moment-timezone from 0.5.31 to 0.5.33 (server#27924)\n- Fix newfileMenu on public page (server#27941)\n- Fix svg icons disapearing in app navigation when text overflows (server#27955)\n- Bump bootstrap from 4.5.2 to 4.5.3 (server#27965)\n- Show registered breadcrumb detail views in breadcrumb menu (server#27970)\n- Fix regression in file sidebar (server#27976)\n- Bump exports-loader from 1.1.0 to 1.1.1 (server#27984)\n- Bump @nextcloud/capabilities from 1.0.2 to 1.0.4 (server#27985)\n- Bump @nextcloud/vue-dashboard from 1.0.0 to 1.0.1 (server#27988)\n- Improve notcreatable permissions hint (server#28006)\n- Update CRL due to revoked twofactor_nextcloud_notification.crt (server#28018)\n- Bump sass-loader from 10.0.2 to 10.0.5 (server#28032)\n- Increase footer height for longer menus (server#28045)\n- Mask password for Redis and RedisCluster on connection failure (server#28054)\n- Fix missing theming for login button (server#28065)\n- Fix overlapping of elements in certain views (server#28072)\n- Disable HEIC image preview provider for performance concerns (server#28081)\n- Improve provider check (server#28087)\n- Sanitize more functions from the encryption app (server#28091)\n- Hide download button for public preview of audio files (server#28096)\n- L10n: HTTP in capital letters (server#28107)\n- Fix dark theme in file exists dialog (server#28111)\n- Let memory limit set in tests fit the used amount (server#28125)\n- User management - Add icon to user groups (server#28172)\n- Bump marked from 1.1.1 to 1.1.2 (server#28187)\n- Fix variable override in file view (server#28191)\n- Bump regenerator-runtime from 0.13.7 to 0.13.9 (server#28207)\n- Bump url-loader from 4.1.0 to 4.1.1 (server#28208)\n- Fix Files breadcrumbs being hidden even if there is enough space (server#28224)\n- Dont apply jail search filter is on the root (server#28241)\n- Check that php was compiled with argon2 support or that the php-sodium extensions is installed (server#28289)\n- Fix preference name when generating notifications (activity#603)\n- Fix monochrome icon detection for correct dark mode invert (activity#607)\n- Fix 'Enable notification emails' (activity#613)\n- Show add, del and restored files within by and self filter (activity#616)\n- Link from app-navigation-settings to personal settings (activity#625)\n- Fix pdfviewer design (files_pdfviewer#446)\n- Include version number in firstrunwizard (firstrunwizard#570)\n- Use notification main link if no parameter has a link (notifications#1040)\n- Bump sass-loader from 10.1.0 to 10.1.1 (text#1360)\n- Bump @babel/plugin-transform-runtime from 7.13.9 to 7.13.15 (text#1548)\n- Bump @babel/preset-env from 7.13.9 to 7.13.15 (text#1550)\n- Bump vue-loader from 15.9.6 to 15.9.7 (text#1592)\n- Unify error responses and add logging where appropriate (text#1719)\n- Disable header timeout on mobile (viewer#978)\n","status":"published","published":"2021-09-14T10:19:48Z","modified":"2026-02-04T04:08:10.133074Z","updated_at":"2026-11-02T16:58:32.266854Z"},{"id":"openSUSE-SU-2021:1255-1","title":"Security update for nextcloud","description":"This update for nextcloud fixes the following issues:\n\nUpdate to 20.0.12\n\nFix boo#1190291 \n\n- CVE-2021-32766 (CWE-209): Generation of Error Message Containing Sensitive Information \n- CVE-2021-32800 (CWE-306): Missing Authentication for Critical Function \n- CVE-2021-32801 (CWE-532): Insertion of Sensitive Information into Log File \n- CVE-2021-32802 (CWE-829): Inclusion of Functionality from Untrusted Control Sphere \n\nChanges\n\n- Bump vue-router from 3.4.3 to 3.4.9 (server#27224)\n- Bump v-click-outside from 3.1.1 to 3.1.2 (server#27232)\n- Bump url-search-params-polyfill from 8.1.0 to 8.1.1 (server#27236)\n- Bump debounce from 1.2.0 to 1.2.1 (server#27646)\n- Bump vue and vue-template-compiler (server#27701)\n- Design fixes to app-settings button (server#27745)\n- Reset checksum when writing files to object store (server#27754)\n- Run s3 tests again (server#27804)\n- Fix in locking cache check (server#27829)\n- Bump dompurify from 2.2.8 to 2.2.9 (server#27836)\n- Make search popup usable on mobile, too (server#27858)\n- Cache images on browser (server#27863)\n- Fix dark theme on public link shares (server#27895)\n- Make user status usable on mobile (server#27897)\n- Do not escape display name in dashboard welcome text (server#27913)\n- Bump moment-timezone from 0.5.31 to 0.5.33 (server#27924)\n- Fix newfileMenu on public page (server#27941)\n- Fix svg icons disapearing in app navigation when text overflows (server#27955)\n- Bump bootstrap from 4.5.2 to 4.5.3 (server#27965)\n- Show registered breadcrumb detail views in breadcrumb menu (server#27970)\n- Fix regression in file sidebar (server#27976)\n- Bump exports-loader from 1.1.0 to 1.1.1 (server#27984)\n- Bump @nextcloud/capabilities from 1.0.2 to 1.0.4 (server#27985)\n- Bump @nextcloud/vue-dashboard from 1.0.0 to 1.0.1 (server#27988)\n- Improve notcreatable permissions hint (server#28006)\n- Update CRL due to revoked twofactor_nextcloud_notification.crt (server#28018)\n- Bump sass-loader from 10.0.2 to 10.0.5 (server#28032)\n- Increase footer height for longer menus (server#28045)\n- Mask password for Redis and RedisCluster on connection failure (server#28054)\n- Fix missing theming for login button (server#28065)\n- Fix overlapping of elements in certain views (server#28072)\n- Disable HEIC image preview provider for performance concerns (server#28081)\n- Improve provider check (server#28087)\n- Sanitize more functions from the encryption app (server#28091)\n- Hide download button for public preview of audio files (server#28096)\n- L10n: HTTP in capital letters (server#28107)\n- Fix dark theme in file exists dialog (server#28111)\n- Let memory limit set in tests fit the used amount (server#28125)\n- User management - Add icon to user groups (server#28172)\n- Bump marked from 1.1.1 to 1.1.2 (server#28187)\n- Fix variable override in file view (server#28191)\n- Bump regenerator-runtime from 0.13.7 to 0.13.9 (server#28207)\n- Bump url-loader from 4.1.0 to 4.1.1 (server#28208)\n- Fix Files breadcrumbs being hidden even if there is enough space (server#28224)\n- Dont apply jail search filter is on the root (server#28241)\n- Check that php was compiled with argon2 support or that the php-sodium extensions is installed (server#28289)\n- Fix preference name when generating notifications (activity#603)\n- Fix monochrome icon detection for correct dark mode invert (activity#607)\n- Fix 'Enable notification emails' (activity#613)\n- Show add, del and restored files within by and self filter (activity#616)\n- Link from app-navigation-settings to personal settings (activity#625)\n- Fix pdfviewer design (files_pdfviewer#446)\n- Include version number in firstrunwizard (firstrunwizard#570)\n- Use notification main link if no parameter has a link (notifications#1040)\n- Bump sass-loader from 10.1.0 to 10.1.1 (text#1360)\n- Bump @babel/plugin-transform-runtime from 7.13.9 to 7.13.15 (text#1548)\n- Bump @babel/preset-env from 7.13.9 to 7.13.15 (text#1550)\n- Bump vue-loader from 15.9.6 to 15.9.7 (text#1592)\n- Unify error responses and add logging where appropriate (text#1719)\n- Disable header timeout on mobile (viewer#978)\n","status":"published","published":"2021-09-14T10:21:06Z","modified":"2026-02-04T03:22:09.613745Z","updated_at":"2026-11-02T16:58:32.266854Z"},{"id":"openSUSE-SU-2021:1275-1","title":"Security update for nextcloud","description":"This update for nextcloud fixes the following issues:\n\nUpdate to 20.0.12\n\nFix boo#1190291 \n\n- CVE-2021-32766 (CWE-209): Generation of Error Message Containing Sensitive Information \n- CVE-2021-32800 (CWE-306): Missing Authentication for Critical Function \n- CVE-2021-32801 (CWE-532): Insertion of Sensitive Information into Log File \n- CVE-2021-32802 (CWE-829): Inclusion of Functionality from Untrusted Control Sphere \n\nChanges\n\n- Bump vue-router from 3.4.3 to 3.4.9 (server#27224)\n- Bump v-click-outside from 3.1.1 to 3.1.2 (server#27232)\n- Bump url-search-params-polyfill from 8.1.0 to 8.1.1 (server#27236)\n- Bump debounce from 1.2.0 to 1.2.1 (server#27646)\n- Bump vue and vue-template-compiler (server#27701)\n- Design fixes to app-settings button (server#27745)\n- Reset checksum when writing files to object store (server#27754)\n- Run s3 tests again (server#27804)\n- Fix in locking cache check (server#27829)\n- Bump dompurify from 2.2.8 to 2.2.9 (server#27836)\n- Make search popup usable on mobile, too (server#27858)\n- Cache images on browser (server#27863)\n- Fix dark theme on public link shares (server#27895)\n- Make user status usable on mobile (server#27897)\n- Do not escape display name in dashboard welcome text (server#27913)\n- Bump moment-timezone from 0.5.31 to 0.5.33 (server#27924)\n- Fix newfileMenu on public page (server#27941)\n- Fix svg icons disapearing in app navigation when text overflows (server#27955)\n- Bump bootstrap from 4.5.2 to 4.5.3 (server#27965)\n- Show registered breadcrumb detail views in breadcrumb menu (server#27970)\n- Fix regression in file sidebar (server#27976)\n- Bump exports-loader from 1.1.0 to 1.1.1 (server#27984)\n- Bump @nextcloud/capabilities from 1.0.2 to 1.0.4 (server#27985)\n- Bump @nextcloud/vue-dashboard from 1.0.0 to 1.0.1 (server#27988)\n- Improve notcreatable permissions hint (server#28006)\n- Update CRL due to revoked twofactor_nextcloud_notification.crt (server#28018)\n- Bump sass-loader from 10.0.2 to 10.0.5 (server#28032)\n- Increase footer height for longer menus (server#28045)\n- Mask password for Redis and RedisCluster on connection failure (server#28054)\n- Fix missing theming for login button (server#28065)\n- Fix overlapping of elements in certain views (server#28072)\n- Disable HEIC image preview provider for performance concerns (server#28081)\n- Improve provider check (server#28087)\n- Sanitize more functions from the encryption app (server#28091)\n- Hide download button for public preview of audio files (server#28096)\n- L10n: HTTP in capital letters (server#28107)\n- Fix dark theme in file exists dialog (server#28111)\n- Let memory limit set in tests fit the used amount (server#28125)\n- User management - Add icon to user groups (server#28172)\n- Bump marked from 1.1.1 to 1.1.2 (server#28187)\n- Fix variable override in file view (server#28191)\n- Bump regenerator-runtime from 0.13.7 to 0.13.9 (server#28207)\n- Bump url-loader from 4.1.0 to 4.1.1 (server#28208)\n- Fix Files breadcrumbs being hidden even if there is enough space (server#28224)\n- Dont apply jail search filter is on the root (server#28241)\n- Check that php was compiled with argon2 support or that the php-sodium extensions is installed (server#28289)\n- Fix preference name when generating notifications (activity#603)\n- Fix monochrome icon detection for correct dark mode invert (activity#607)\n- Fix 'Enable notification emails' (activity#613)\n- Show add, del and restored files within by and self filter (activity#616)\n- Link from app-navigation-settings to personal settings (activity#625)\n- Fix pdfviewer design (files_pdfviewer#446)\n- Include version number in firstrunwizard (firstrunwizard#570)\n- Use notification main link if no parameter has a link (notifications#1040)\n- Bump sass-loader from 10.1.0 to 10.1.1 (text#1360)\n- Bump @babel/plugin-transform-runtime from 7.13.9 to 7.13.15 (text#1548)\n- Bump @babel/preset-env from 7.13.9 to 7.13.15 (text#1550)\n- Bump vue-loader from 15.9.6 to 15.9.7 (text#1592)\n- Unify error responses and add logging where appropriate (text#1719)\n- Disable header timeout on mobile (viewer#978)\n","status":"published","published":"2021-09-16T10:07:16Z","modified":"2026-02-04T03:52:26.191379Z","updated_at":"2026-11-02T16:58:32.266854Z"}]}}