User Credentials Exposure in Nextcloud by Inadequate Access Control

CVE-2021-22877

What is CVE-2021-22877?

An inadequate user verification mechanism in Nextcloud versions prior to 20.0.6 can unintentionally assign a user's credentials to the configuration of external storage for other users. This issue arises when a user attempts to set up external storage but lacks pre-configured settings, resulting in unauthorized access to sensitive data. It is crucial for administrators to update their Nextcloud installations to mitigate this security risk.

References