CVE-2021-39225

Nextcloud is an open-source, self-hosted productivity platform. A missing permission check in Nextcloud Deck before 1.2.9, 1.4.5 and 1.5.3 allows another authenticated users to access Deck cards of another user. It is recommended that the Nextcloud Deck App is upgraded to 1.2.9, 1.4.5 or 1.5.3. There are no known workarounds aside from upgrading.

• CWE-639
• CWE-862

• https://github.com/nextcloud/deck/pull/3316Patch, Third Party Advisory
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-2x96-38qg-3m72Third Party Advisory
• https://hackerone.com/reports/1331728Permissions Required, Third Party Advisory
• https://github.com/nextcloud/deck/pull/3316Patch, Third Party Advisory
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-2x96-38qg-3m72Third Party Advisory
• https://hackerone.com/reports/1331728Permissions Required, Third Party Advisory

Published

Oct 25, 2021

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-3922A race condition vulnerability was reported in IMController,…7
• CVE-2021-39220Nextcloud is an open-source, self-hosted productivity platfo…3.5
• CVE-2021-39221Nextcloud is an open-source, self-hosted productivity platfo…5.4
• CVE-2021-39222Nextcloud is an open-source, self-hosted productivity platfo…6.1
• CVE-2021-39223Nextcloud is an open-source, self-hosted productivity platfo…5.3
• CVE-2021-39224Nextcloud is an open-source, self-hosted productivity platfo…5.3
• CVE-2021-39226Grafana is an open source data visualization platform. In af…7.3
• CVE-2021-39227ZRender is a lightweight graphic library providing 2d draw f…9.8
• CVE-2021-39228Tremor is an event processing system for unstructured data. …9.8
• CVE-2021-39229Apprise is an open source library which allows you to send a…7.5
• CVE-2021-3923A flaw was found in the Linux kernel's implementation of RDM…2.3
• CVE-2021-39230Butter is a system usability utility. Due to a kernel error …6.5