Security readout for executives and security teams
Plain-English summary
A logged-in Nextcloud user could join a Secret Circle without the circle owner approving it. That could expose private information shared inside those circles. The sources do not claim system takeover, data modification, or service disruption, but confidentiality impact is high for affected Circles deployments.
Executive priority
Treat this as a confidentiality issue requiring timely patching, not an emergency internet-wide takeover scenario. Prioritize affected Nextcloud instances used for sensitive collaboration, regulated data, or customer information.
Technical view
CVE-2021-37630 is an authorization bypass in Nextcloud Circles, mapped to CWE-639. Affected versions allow any authenticated user to join Secret Circles without owner approval. CVSS 3.1 is 6.5: network exploitable, low complexity, privileges required, no user interaction, high confidentiality impact only.
Likely exposure
Exposure is limited to Nextcloud environments running the Circles app in affected version ranges: before 0.19.15, 0.20.0 through before 0.20.11, and 0.21.0 through before 0.21.4. Risk is higher where many internal users exist or Secret Circles contain sensitive content.
Exploitation context
The provided sources do not report active exploitation, and the CVE is not listed as KEV. Exploitation requires a valid user account and network access to the Nextcloud instance. No public source in the bundle supports unauthenticated exploitation.
Researcher notes
Evidence supports an authenticated authorization bypass affecting Secret Circle membership approval. CVSS vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. The bundle names fixed versions and no workaround, but does not provide active exploitation evidence.
Mitigation direction
- Upgrade Nextcloud Circles to 0.19.15, 0.20.11, 0.21.4, or later supported releases.
- Prioritize instances where Secret Circles store sensitive internal or customer information.
- Check Nextcloud vendor guidance before applying any compensating controls.
- Note that the advisory states there are no workarounds.
Validation and detection
- Inventory Nextcloud instances using the Circles app and record installed app versions.
- Flag Circles versions below the fixed releases for their branch.
- Review Secret Circle memberships for unexpected users after patching.
- Confirm the updated Circles package is deployed across all environments.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-639: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCredential and access behavior lookup
The CVE wording references authentication or credential exposure, so valid-account and credential-access review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2021-37630 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N2.83.6Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
6.5MediumVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-56j9-3rj4-wvgmCVE reference · x_refsource_CONFIRM
- https://github.com/nextcloud/circles/pull/768CVE reference · x_refsource_MISC
- https://hackerone.com/reports/1257624CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Authorization Bypass Through User-Controlled Key
Authorization Bypass Through User-Controlled Key represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.