VULNERABILITY INTELLIGENCE

CVE-2021-37630

CVSS score6.5 MEDIUM

EPSS probability1.20%

CISA KEVNot currently listed

Published2021-09-07

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Description

Nextcloud Circles is an open source social network built for the nextcloud ecosystem. In affected versions the Nextcloud Circles application allowed any user to join any "Secret Circle" without approval by the Circle owner leaking private information. It is recommended that Nextcloud Circles is upgraded to 0.19.15, 0.20.11 or 0.21.4. There are no workarounds for this issue.

Weakness classification

CWE-639: Authorization Bypass Through User-Controlled Key

Primary references

security-advisories@github.com — Patch, Third Party Advisory
security-advisories@github.com — Third Party Advisory
security-advisories@github.com — Permissions Required, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Permissions Required, Third Party Advisory