CVE-2021-41166: Permission bypass in Nextcloud Android App
The Nextcloud Android app is the Android client for Nextcloud, a self-hosted productivity platform. An issue in versions prior to 3.17.1 may lead to sensitive information disclosure. An unauthorized app that does not have the otherwise required MANAGEDOCUMENTS permission may view image thumbnails for images it does not have permission to view. Version 3.17.1 contains a patch. There are no known workarounds.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2021-41166?
CVE-2021-41166 is a vulnerability in the Nextcloud Android app that may lead to sensitive information disclosure.
What is the severity of CVE-2021-41166?
The severity of CVE-2021-41166 is medium with a CVSS score of 5.3.
How does CVE-2021-41166 impact Nextcloud Android app?
CVE-2021-41166 in the Nextcloud Android app may allow an unauthorized app to view image thumbnails without the required permissions.
Which versions of the Nextcloud Android app are affected by CVE-2021-41166?
Versions prior to 3.17.1 of the Nextcloud Android app are affected by CVE-2021-41166.
How can I fix CVE-2021-41166?
To fix CVE-2021-41166, update the Nextcloud Android app to version 3.17.1 or newer.