What’s Vulnerable › Vulnerabilities

CVE-2021-22906

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-06-11 · updated 2026-06-17
• Weakness: CWE-400

Description

Nextcloud End-to-End Encryption before 1.5.3, 1.6.3 and 1.7.1 suffers from a denial of service vulnerability due to permitting any authenticated users to lock files of other users.

Affected products

• Nextcloud End-to-End Encryption: before 1.5.3; from 1.6.0 before 1.6.3; from 1.7.0 before 1.7.1 — fixed in 1.5.3, 1.6.3, 1.7.1

How to fix

Upgrade to a fixed version: Nextcloud End-to-End Encryption 1.5.3, 1.6.3, 1.7.1. Check the vendor advisory for mitigations.

References

• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-3829-45wm-ww36
• https://hackerone.com/reports/1189174
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-3829-45wm-ww36
• https://hackerone.com/reports/1189174

Get alerted when CVE-2021-22906 or the next vulnerability affects your stack