CVE-2021-37631

    Dashboard / Vulnerabilities / CVE-2021-37631

    CVE-2021-37631

    Published: 7 Sept 2021Last Modified: 9 Jul 2026

    Summary:

    Details: Deck is an open source kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. In affected versions the Deck application didn't properly check membership of users in a Circle. This allowed other users in the instance to gain access to boards that have been shared with a Circle, even if the user was not a member of the circle. It is recommended that Nextcloud Deck is upgraded to 1.5.1, 1.4.4 or 1.2.9. If you are unable to update it is advised to disable the Deck plugin.

    References: https://github.com/nextcloud/security-advisories/security/advisories/GHSA-4mxp-j277-82hr, https://hackerone.com/reports/1256021, https://hackerone.com/reports/1280931, https://github.com/nextcloud/deck/pull/3217

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -869aba34d92660d87fd66c90459e50186f3b07d5

    Affected versions

    v1.2.8
    v1.2.7
    v1.2.6
    v1.2.5
    v1.2.4
    v1.2.3
    v1.2.2
    v1.2.1
    v1.2.0
    v1.2.0-beta1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2021-37631 | CVE-DB