CVE-2021-41166

The Nextcloud Android app is the Android client for Nextcloud, a self-hosted productivity platform. An issue in versions prior to 3.17.1 may lead to sensitive information disclosure. An unauthorized app that does not have the otherwise required `MANAGE_DOCUMENTS` permission may view image thumbnails for images it does not have permission to view. Version 3.17.1 contains a patch. There are no known workarounds.

• CWE-276
• CWE-276

• https://github.com/nextcloud/android/commit/aa47197109970b8449c4e44601eba36e3481b086Patch, Third Party Advisory
• https://github.com/nextcloud/android/commit/b6ecf515b38c2d82d32743f27236534f3e03ee0cPatch, Third Party Advisory
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-wrwg-jwpg-r3c4Patch, Third Party Advisory
• https://hackerone.com/reports/1358597Permissions Required
• https://github.com/nextcloud/android/commit/aa47197109970b8449c4e44601eba36e3481b086Patch, Third Party Advisory
• https://github.com/nextcloud/android/commit/b6ecf515b38c2d82d32743f27236534f3e03ee0cPatch, Third Party Advisory
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-wrwg-jwpg-r3c4Patch, Third Party Advisory
• https://hackerone.com/reports/1358597Permissions Required

Published

Jan 26, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-41160FreeRDP is a free implementation of the Remote Desktop Proto…8.8
• CVE-2021-41161Combodo iTop is a web based IT Service Management tool. In v…6.1
• CVE-2021-41162Combodo iTop is a web based IT Service Management tool. In 3…6.1
• CVE-2021-41163Discourse is an open source platform for community discussio…9.8
• CVE-2021-41164CKEditor4 is an open source WYSIWYG HTML editor. In affected…5.4
• CVE-2021-41165CKEditor4 is an open source WYSIWYG HTML editor. In affected…5.4
• CVE-2021-41167modern-async is an open source JavaScript tooling library fo…7.5
• CVE-2021-41168Snudown is a reddit-specific fork of the Sundown Markdown pa…6.5
• CVE-2021-41169Sulu is an open-source PHP content management system based o…4.8
• CVE-2021-4117yetiforcecrm is vulnerable to Business Logic Errors4.3
• CVE-2021-41170neoan3-apps/template is a neoan3 minimal template engine. Ve…9.8
• CVE-2021-41171eLabFTW is an open source electronic lab notebook manager fo…8.8