CVE-2021-32801

Nextcloud server is an open source, self hosted personal cloud. In affected versions logging of exceptions may have resulted in logging potentially sensitive key material for the Nextcloud Encryption-at-Rest functionality. It is recommended that the Nextcloud Server is upgraded to 20.0.12, 21.0.4 or 22.1.0. If upgrading is not an option users are advised to disable system logging to resolve this issue until such time that an upgrade can be performed Note that ff you do not use the Encryption-at-Rest functionality of Nextcloud you are not affected by this bug.

• CWE-532
• CWE-532

• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-mcpf-v65v-359hThird Party Advisory
• https://github.com/nextcloud/server/pull/28082Third Party Advisory
• https://hackerone.com/reports/1251776Permissions Required, Third Party Advisory
• https://security.gentoo.org/glsa/202208-17Third Party Advisory
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-mcpf-v65v-359hThird Party Advisory
• https://github.com/nextcloud/server/pull/28082Third Party Advisory
• https://hackerone.com/reports/1251776Permissions Required, Third Party Advisory
• https://security.gentoo.org/glsa/202208-17Third Party Advisory

Published

Sep 7, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-32794ArchiSteamFarm is a C# application with primary purpose of i…7.5
• CVE-2021-32795ArchiSteamFarm is a C# application with primary purpose of i…5.9
• CVE-2021-32796xmldom is an open source pure JavaScript W3C standard-based …5.3
• CVE-2021-32797JupyterLab is a user interface for Project Jupyter which wil…9.6
• CVE-2021-32798The Jupyter notebook is a web-based notebook environment for…9.6
• CVE-2021-32800Nextcloud server is an open source, self hosted personal clo…8.1
• CVE-2021-32802Nextcloud server is an open source, self hosted personal clo…9.8
• CVE-2021-32803The npm package "tar" (aka node-tar) before versions 6.1.2, …8.1
• CVE-2021-32804The npm package "tar" (aka node-tar) before versions 6.1.1, …8.1
• CVE-2021-32805Flask-AppBuilder is an application development framework, bu…6.1
• CVE-2021-32806Products.isurlinportal is a replacement for isURLInPortal me…6.1
• CVE-2021-32807The module `AccessControl` defines security policies for Pyt…7.2