What’s Vulnerable › Vulnerabilities

CVE-2021-37630: Secret Circle can be joined without approval in Nextcloud Circles

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-09-07 · updated 2026-06-17
• Weakness: CWE-639

Description

Nextcloud Circles is an open source social network built for the nextcloud ecosystem. In affected versions the Nextcloud Circles application allowed any user to join any "Secret Circle" without approval by the Circle owner leaking private information. It is recommended that Nextcloud Circles is upgraded to 0.19.15, 0.20.11 or 0.21.4. There are no workarounds for this issue.

Affected products

• Nextcloud Circles: before 0.19.5; from 0.20.0 before 0.20.11; from 0.21.0 before 0.21.4 — fixed in 0.19.5, 0.20.11, 0.21.4

How to fix

Upgrade to a fixed version: Nextcloud Circles 0.19.5, 0.20.11, 0.21.4. Check the vendor advisory for mitigations.

References

• https://github.com/nextcloud/circles/pull/768
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-56j9-3rj4-wvgm
• https://hackerone.com/reports/1257624
• https://github.com/nextcloud/circles/pull/768
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-56j9-3rj4-wvgm
• https://hackerone.com/reports/1257624

Get alerted when CVE-2021-37630 or the next vulnerability affects your stack