Security readout for executives and security teams
Plain-English summary
CVE-2021-32656 lets an unauthenticated attacker learn basic user information from vulnerable Nextcloud Server instances through a federated sharing/trusted-server workflow. The issue affects versions before 19.0.11, 20.0.10, and 21.0.2. It is confidentiality-focused: sources do not describe data modification or service disruption.
Executive priority
Prioritize remediation for externally reachable Nextcloud services because the bug can expose user information without authentication. It is not described as system takeover, but user enumeration and disclosure can support later phishing, credential attacks, or targeting.
Technical view
Nextcloud federated share handling could allow trusted-server exchange to be triggered through a public link that a legitimate user added as a federated share. The CVSS vector is network, low complexity, no privileges, no user interaction, changed scope, high confidentiality impact, no integrity or availability impact. The mapped weakness is CWE-284.
Likely exposure
Exposure is most likely on internet-accessible Nextcloud Server deployments running vulnerable 19.x, 20.x, or 21.x versions with federated sharing enabled. Risk is higher where users create public links and the setting to automatically add servers after successful federated shares is enabled.
Exploitation context
The source bundle does not cite CISA KEV listing or active exploitation. Public sources describe unauthenticated network reachability and information disclosure, but do not provide evidence here of exploitation in the wild. Treat as plausible external exposure rather than confirmed active abuse.
Researcher notes
Focus validation on version, federated sharing configuration, automatic server-add behavior, and public-link exposure. The provided evidence supports high confidentiality impact and vendor-fixed versions. It does not support claims of active exploitation, broader product impact, or additional mitigations beyond upgrade and disabling the named setting.
Mitigation direction
- Upgrade Nextcloud Server to 19.0.11, 20.0.10, 21.0.2, or later supported releases.
- Disable "Add server automatically once a federated share was created successfully" if immediate upgrade is not possible.
- Review vendor guidance before changing federated sharing behavior in production.
- Prioritize internet-facing or externally shared Nextcloud instances first.
Validation and detection
- Inventory Nextcloud Server versions and identify any below 19.0.11, 20.0.10, or 21.0.2.
- Check whether federated sharing and automatic trusted-server addition are enabled.
- Review public link and federated share usage for exposed workflows.
- Confirm upgraded instances report patched versions after maintenance.
- Review access logs for unusual public-link activity, without attempting exploitation.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-284: Authorization and privilege behavior lookup
Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2021-32656 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.6 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N3.94Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
8.6HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-j875-vr2q-h6x6CVE reference · x_refsource_CONFIRM
- https://hackerone.com/reports/1167853CVE reference · x_refsource_MISC
- GLSA-202208-17CVE reference · vendor-advisory, x_refsource_GENTOO
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Access Control
Improper Access Control represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.