{"id":"CVE-2021-41256","aliases":["EUVD-2021-28301","GHSA-2q9v-q3cc-h9f3"],"status":"published","title":"Intent URI permissions manipulation in nextcloud news-android","description":"nextcloud news-android is an Android client for the Nextcloud news/feed reader app. In affected versions the Nextcloud News for Android app has a security issue by which a malicious application installed on the same device can send it an arbitrary Intent that gets reflected back, unintentionally giving read and write access to non-exported Content Providers in Nextcloud News for Android. Users should upgrade to version 0.9.9.63 or higher as soon as possible.","severity":{"version":"3.1","score":5.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.01113,"percentile":0.66413,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-829"],"published":"2021-11-30T20:55:09Z","modified":"2026-10-20T14:28:18Z","products":[{"vendor":"nextcloud","product":"news"},{"vendor":"nextcloud","product":"news-android"}],"references":[{"url":"https://github.com/nextcloud/news-android/security/advisories/GHSA-2q9v-q3cc-h9f3","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://github.com/nextcloud/news-android/commit/05449cb666059af7de2302df9d5c02997a23df85","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://github.com/nextcloud/news-android/blob/master/security/GHSL-2021-1033_Nextcloud_News_for_Android.md","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence"]}],"sources":{"cve":[{"id":"CVE-2021-41256","title":"Intent URI permissions manipulation in nextcloud news-android","description":"nextcloud news-android is an Android client for the Nextcloud news/feed reader app. In affected versions the Nextcloud News for Android app has a security issue by which a malicious application installed on the same device can send it an arbitrary Intent that gets reflected back, unintentionally giving read and write access to non-exported Content Providers in Nextcloud News for Android. Users should upgrade to version 0.9.9.63 or higher as soon as possible.","status":"published","published":"2021-11-30T20:55:09Z","modified":"2024-08-04T03:08:31.607Z","cvss":[{"version":"3.1","score":5.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-829"],"updated_at":"2026-11-02T14:32:59.105382Z"}],"euvd":[{"id":"EUVD-2021-28301","description":"nextcloud news-android is an Android client for the Nextcloud news/feed reader app. In affected versions the Nextcloud News for Android app has a security issue by which a malicious application installed on the same device can send it an arbitrary Intent that gets reflected back, unintentionally giving read and write access to non-exported Content Providers in Nextcloud News for Android. Users should upgrade to version 0.9.9.63 or higher as soon as possible.","status":"published","published":"2021-11-30T20:55:09Z","modified":"2024-08-04T03:08:31Z","cvss":[{"version":"3.1","score":5.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N","level":"medium"}],"updated_at":"2026-11-03T03:24:18.226903Z"}],"nvd":[{"id":"CVE-2021-41256","description":"nextcloud news-android is an Android client for the Nextcloud news/feed reader app. In affected versions the Nextcloud News for Android app has a security issue by which a malicious application installed on the same device can send it an arbitrary Intent that gets reflected back, unintentionally giving read and write access to non-exported Content Providers in Nextcloud News for Android. Users should upgrade to version 0.9.9.63 or higher as soon as possible.","status":"published","published":"2021-11-30T21:15:08.227Z","modified":"2026-06-17T04:08:11.207Z","cvss":[{"version":"3.1","score":5.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-829"],"updated_at":"2026-11-02T14:07:01.811115Z"}],"osv":[{"id":"CVE-2021-41256","description":"nextcloud news-android is an Android client for the Nextcloud news/feed reader app. In affected versions the Nextcloud News for Android app has a security issue by which a malicious application installed on the same device can send it an arbitrary Intent that gets reflected back, unintentionally giving read and write access to non-exported Content Providers in Nextcloud News for Android. Users should upgrade to version 0.9.9.63 or higher as soon as possible.","status":"published","published":"2021-11-30T21:15:08.227Z","modified":"2026-10-20T14:28:18.791249657Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:21.557945Z"}]}}