CVE-2021-39225

    Dashboard / Vulnerabilities / CVE-2021-39225

    CVE-2021-39225

    Published: 25 Oct 2021Last Modified: 9 Jul 2026

    Summary:

    Details: Nextcloud is an open-source, self-hosted productivity platform. A missing permission check in Nextcloud Deck before 1.2.9, 1.4.5 and 1.5.3 allows another authenticated users to access Deck cards of another user. It is recommended that the Nextcloud Deck App is upgraded to 1.2.9, 1.4.5 or 1.5.3. There are no known workarounds aside from upgrading.

    References: https://github.com/nextcloud/security-advisories/security/advisories/GHSA-2x96-38qg-3m72, https://hackerone.com/reports/1331728, https://github.com/nextcloud/deck/pull/3316

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -869aba34d92660d87fd66c90459e50186f3b07d5

    Affected versions

    v1.4.4
    v1.4.3
    v1.4.2
    v1.4.1
    v1.4.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2021-39225 | CVE-DB