What’s Vulnerable › Vulnerabilities

CVE-2021-41166: Permission bypass in Nextcloud Android App

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-01-26 · updated 2026-06-17
• Weakness: CWE-276

Description

The Nextcloud Android app is the Android client for Nextcloud, a self-hosted productivity platform. An issue in versions prior to 3.17.1 may lead to sensitive information disclosure. An unauthorized app that does not have the otherwise required `MANAGE_DOCUMENTS` permission may view image thumbnails for images it does not have permission to view. Version 3.17.1 contains a patch. There are no known workarounds.

Affected products

• com.nextcloud.client: before 3.17.1 — fixed in 3.17.1

How to fix

Upgrade to a fixed version: com.nextcloud.client 3.17.1. Check the vendor advisory for mitigations.

References

• https://github.com/nextcloud/android/commit/aa47197109970b8449c4e44601eba36e3481b086
• https://github.com/nextcloud/android/commit/b6ecf515b38c2d82d32743f27236534f3e03ee0c
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-wrwg-jwpg-r3c4
• https://hackerone.com/reports/1358597
• https://github.com/nextcloud/android/commit/aa47197109970b8449c4e44601eba36e3481b086
• https://github.com/nextcloud/android/commit/b6ecf515b38c2d82d32743f27236534f3e03ee0c
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-wrwg-jwpg-r3c4
• https://hackerone.com/reports/1358597

Get alerted when CVE-2021-41166 or the next vulnerability affects your stack