CVE-2021-22896

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2021-22896
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-22896.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2021-22896
Aliases
Published
2021-06-11T16:15:10Z
Modified
2026-10-24T10:50:40Z
Severity
  • 4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N CVSS Calculator
Summary
[none]
Details

Nextcloud Mail before 1.9.5 suffers from improper access control due to a missing permission check allowing other authenticated users to create mail aliases for other users.

Database specific 
{
    "unresolved_ranges": [
        {
            "cpes": [
                "cpe:2.3:a:nextcloud:nextcloud:*:*:*:*:*:*:*:*"
            ],
            "extracted_events": [
                {
                    "range": [
                        {
                            "fixed": "1.9.5"
                        },
                        {
                            "fixed": "1.9.5"
                        },
                        {
                            "fixed": "1.9.5"
                        }
                    ],
                    "source": "CPE_RANGE"
                }
            ],
            "vendor_product": "nextcloud:nextcloud"
        },
        {
            "extracted_events": [
                {
                    "range": [
                        {
                            "fixed": "1.9.5"
                        }
                    ],
                    "source": "DESCRIPTION"
                }
            ]
        }
    ]
}
References

Affected packages

Git / github.com/nextcloud/mail

Affected ranges

Type
GIT
Repo
https://github.com/nextcloud/mail
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
11434a58dd79fccb02de18cead5b37dfe0c6e871
Database specific
Show details 
{
    "extracted_events": [
        {
            "original_tag": "v1.9.5",
            "range": [
                {
                    "fixed": "11434a58dd79fccb02de18cead5b37dfe0c6e871"
                }
            ],
            "source": "REFERENCES_TAG"
        }
    ]
}

Affected versions

1.*
1.6.2
Other
nighly-20170831
nightly-20161202
nightly-20161208
nightly-20161218
nightly-20170117
nightly-20170612
nightly-20170823
nightly-20170831
nightly-20170906
nightly-20170913
nightly-20171127
nightly-20171212
nightly-20180410
nightly-20200115
nightly-20200423
nightly-20200427
nightly-20200506
nightly-20200513
untagged-bd8a3cab1eb0022ec683
v0.*
v0.1.0
v0.1.3
v0.10.0
v0.11.0
v0.12.0
v0.12.0-RC2
v0.12.0-RC3
v0.12.0-alpha3
v0.12.0-beta1
v0.12.0-beta2
v0.12.0-beta4
v0.12.0-beta5
v0.13.0
v0.14.0
v0.15.0
v0.15.1
v0.15.2
v0.15.3
v0.15.4
v0.15.5
v0.16.0
v0.17.0
v0.18.0
v0.18.0-RC1
v0.18.1
v0.19.0
v0.19.1
v0.2.0
v0.20.0
v0.20.1
v0.20.2
v0.20.3
v0.21.0
v0.21.1
v0.3.0
v0.4.0
v0.4.1
v0.4.2
v0.4.3
v0.4.4
v0.5.0
v0.5.1
v0.5.2
v0.6.2
v0.7.0
v0.7.1
v0.7.10
v0.7.2
v0.7.3
v0.7.4
v0.7.5
v0.7.6
v0.7.7
v0.7.8
v0.7.9
v0.8.0
v0.8.0-alpha1
v0.8.0-beta1
v0.8.1
v0.8.2
v0.8.3
v0.9.0
v1.*
v1.0.0
v1.1.0
v1.1.1
v1.1.2
v1.3.0
v1.3.0-RC1
v1.3.0-beta1
v1.3.0-beta2
v1.3.0-beta3
v1.3.1
v1.3.2
v1.3.3
v1.4.0-beta1
v1.4.0-beta2
v1.4.0-rc1
v1.5.0
v1.5.0-alpha3
v1.5.0-beta1
v1.5.0-beta2
v1.5.0-beta3
v1.5.0-rc1
v1.5.0-rc2
v1.6.0
v1.7.0
v1.8.0
v1.9.0
v1.9.0-alpha2
v1.9.0-alpha3
v1.9.1
v1.9.2
v1.9.3
v1.9.4

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-22896.json"