CVE-2021-41239

Nextcloud server is a self hosted system designed to provide cloud style services. In affected versions the User Status API did not consider the user enumeration settings by the administrator. This allowed a user to enumerate other users on the instance, even when user listings where disabled. It is recommended that the Nextcloud Server is upgraded to 20.0.14, 21.0.6 or 22.2.1. There are no known workarounds.

• CWE-200
• CWE-862

• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-g722-cm3h-8wrxIssue Tracking, Third Party Advisory
• https://github.com/nextcloud/server/issues/27122Issue Tracking, Patch, Third Party Advisory
• https://github.com/nextcloud/server/pull/29260Patch, Third Party Advisory
• https://security.gentoo.org/glsa/202208-17Third Party Advisory
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-g722-cm3h-8wrxIssue Tracking, Third Party Advisory
• https://github.com/nextcloud/server/issues/27122Issue Tracking, Patch, Third Party Advisory
• https://github.com/nextcloud/server/pull/29260Patch, Third Party Advisory
• https://security.gentoo.org/glsa/202208-17Third Party Advisory

Published

Mar 8, 2022

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-41230Pomerium is an open source identity-aware access proxy. In a…8.8
• CVE-2021-41231OpenMage LTS is an e-commerce platform. Prior to versions 19…7.2
• CVE-2021-41232Thunderdome is an open source agile planning poker tool in t…9.8
• CVE-2021-41233Nextcloud text is a collaborative document editing using Mar…5.3
• CVE-2021-41236OroPlatform is a PHP Business Application Platform. In affec…4.8
• CVE-2021-41238Hangfire is an open source system to perform background job …7.5
• CVE-2021-4124janus-gateway is vulnerable to Improper Neutralization of In…6.1
• CVE-2021-41241Nextcloud server is a self hosted system designed to provide…4.3
• CVE-2021-41242OpenOlat is a web-basedlearning management system. A path tr…8.1
• CVE-2021-41243There is a Potential Zip Slip Vulnerability and OS Command I…8.8
• CVE-2021-41244Grafana is an open-source platform for monitoring and observ…7.2
• CVE-2021-41245Combodo iTop is a web based IT Service Management tool. In v…8.1