CVE-2021-32652: Nextcloud Mail is a mail app for the Nextcloud platform. A missing permission check in Nextcloud Mail before 1.4.3 and 1.8.2 allows another authenticated users…

PriorityP421medium4.3CVSS 3.1

AVNACLPRLUINSUCLINAN

EPSS

1.11%

61.7th percentile

Nextcloud Mail is a mail app for the Nextcloud platform. A missing permission check in Nextcloud Mail before 1.4.3 and 1.8.2 allows another authenticated users to access mail metadata of other users. Versions 1.4.3 and 1.8.2 contain patches for this vulnerability; no workarounds other than the patches are known to exist.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
nextcloud	mail	< 1.4.3	1.4.3
nextcloud	mail	>= 1.5.5 < 1.8.2	1.8.2
nextcloud	security-advisories	< 1.4.3	1.4.3
nextcloud	security-advisories	—	—

CVSS provenance

nvdv3.14.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

nvdv2.04.0MEDIUMAV:N/AC:L/Au:S/C:P/I:N/A:N

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.