CVE-2021-32727

    Dashboard / Vulnerabilities / CVE-2021-32727

    CVE-2021-32727

    Published: 12 Jul 2021Last Modified: 7 Aug 2026

    Summary:

    Details: Nextcloud Android Client is the Android client for Nextcloud. Clients using the Nextcloud end-to-end encryption feature download the public and private key via an API endpoint. In versions prior to 3.16.1, the Nextcloud Android client skipped a step that involved the client checking if a private key belonged to a previously downloaded public certificate. If the Nextcloud instance served a malicious public key, the data would be encrypted for this key and thus could be accessible to a malicious actor. The vulnerability is patched in version 3.16.1. As a workaround, do not add additional end-to-end encrypted devices to a user account.

    References: https://github.com/nextcloud/android/pull/8438, https://github.com/nextcloud/end_to_end_encryption_rfc/blob/7f002996397faefb664019a97ebb0a1e210f64f0/RFC.md#further-devices, https://github.com/nextcloud/security-advisories/security/advisories/GHSA-5v33-r9cm-7736, https://hackerone.com/reports/1189162

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -5b68a3a475acd0378f91f44dd5eedd79a454b952

    Affected versions

    rc-3.16.1-01
    rc-3.16.0-02
    rc-3.16.0-01

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High