Medium
Security advisory
Nextcloud server is a self hosted system designed to provide cloud style services. In affected versions the User Status API did not consider the user enumeration settings by the administrator. This allowed a user to enumerate other users on the instance, even when user listings where disabled. It is recommended that the Nextcloud Server is upgraded to 20.0.14, 21.0.6 or 22.2.1. There are no known workarounds.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2021-41239
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 11:56 UTC · Revision 1
Source evidence
Nextcloud server is a self hosted system designed to provide cloud style services. In affected versions the User Status API did not consider the user enumeration settings by the administrator. This allowed a user to enumerate other users on the instance, even when user listings where disabled. It is recommended that the Nextcloud Server is upgraded to 20.0.14, 21.0.6 or 22.2.1. There are no known workarounds.
osv:CVE-2021-41239
Complete source record
{
"id": "adf45377b1998cf12e1f121f97fed10f0209f99cc35de237d7773876a8d270d4",
"url": "https://osv.dev/vulnerability/CVE-2021-41239",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2021-41239",
"summary": "Nextcloud server is a self hosted system designed to provide cloud style services. In affected versions the User Status API did not consider the user enumeration settings by the administrator. This allowed a user to enumerate other users on the instance, even when user listings where disabled. It is recommended that the Nextcloud Server is upgraded to 20.0.14, 21.0.6 or 22.2.1. There are no known workarounds.",
"evidence": "osv:CVE-2021-41239",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2021-41239",
"aliases": [
"CVE-2021-41239",
"GHSA-g722-cm3h-8wrx"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/nextcloud/server",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "50221f94abea4f26710091d94f2930a0322036bc"
},
{
"introduced": "8985b7930653139859002eb3eca2852999ed8f0d"
},
{
"fixed": "5b0854cd30ff7d35192e99b83709da3c6c579924"
},
{
"introduced": "07e359b7de671a81a7baad701d4496a9f871a770"
},
{
"last_affected": "07e359b7de671a81a7baad701d4496a9f871a770"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "20.0.14"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "21.0.0"
},
{
"fixed": "21.0.6"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:nextcloud:nextcloud_server:22.2.0:*:*:*:*:*:*:*",
"range": [
{
"introduced": "22.2.0"
},
{
"last_affected": "22.2.0"
}
],
"source": "CPE_STRING"
}
]
}
}
],
"versions": [
"22.2.0",
"v20.0.14rc1",
"v21.0.6rc1",
"v20.0.13",
"v21.0.5",
"v22.2.0",
"v20.0.13rc1",
"v21.0.5rc1",
"v21.0.4",
"v21.0.4rc1",
"v20.0.11",
"v21.0.3",
"v21.0.3rc1",
"v20.0.11rc1",
"v20.0.10",
"v21.0.2",
"v20.0.10RC1",
"v21.0.2RC1",
"v20.0.9",
"v21.0.1",
"v21.0.1RC1",
"v20.0.9RC1",
"v20.0.8",
"v21.0.0",
"v20.0.8RC1",
"v20.0.7RC1",
"v20.0.7",
"v20.0.6",
"v20.0.6RC1",
"v20.0.5",
"v20.0.5RC2",
"v20.0.5RC1",
"v20.0.4",
"v20.0.3",
"v20.0.3RC2",
"v20.0.2",
"v20.0.2RC2",
"v20.0.2RC1",
"v20.0.1",
"v20.0.1RC1",
"v20.0.0",
"v20.0.0RC2",
"v20.0.0RC1",
"v20.0.0beta4",
"v20.0.0beta3",
"v20.0.0beta2",
"v20.0.0beta1",
"v19.0.0RC2",
"v19.0.0RC1",
"v19.0.0beta7",
"v19.0.0beta6",
"v19.0.0beta5",
"v19.0.0beta4",
"v19.0.0beta3",
"v19.0.0beta2",
"v19.0.0beta1",
"v18.0.0RC1",
"v18.0.0beta4",
"v18.0.0beta3",
"v18.0.0beta2",
"v18.0.0beta1",
"v17.0.0beta4",
"v17.0.0beta3",
"v17.0.0beta2",
"v17.0.0beta1",
"v16.0.0RC1",
"v16.0.0beta3",
"v16.0.0beta2",
"v16.0.0beta1",
"v16.0.0alpha1",
"v15.0.0RC1",
"v15.0.0beta2",
"v15.0.0beta1",
"v14.0.0RC2",
"v14.0.0RC1",
"v14.0.0beta4",
"v14.0.0beta3",
"v14.0.0beta2",
"v14.0.0beta1",
"v13.0.0RC1",
"v13.0.0beta4",
"v13.0.0beta3",
"v13.0.0beta2",
"v13.0.0beta1",
"v12.0.0beta4",
"v12.0.0beta3",
"v12.0.0beta2",
"v12.0.0beta1",
"v11.0.0",
"v11.0RC2",
"v9.1.0beta1",
"v9.0.0beta2",
"v9.0beta1",
"v8.2RC1",
"v8.2beta1",
"v8.1RC2",
"v8.1.0beta2",
"v8.1.0beta1",
"v8.1.0alpha2",
"v8.1.0alpha1",
"v8.0.0",
"v8.0.0RC2",
"v8.0.0RC1",
"v8.0.0beta2",
"v8.0.0beta1",
"v8.0.0alpha2",
"v8.0.0alpha1",
"v7.0.0beta1",
"v7.0.0alpha2",
"v6.0.0RC2",
"v6.0.0RC1",
"v6.0.0beta5",
"v6.0.0beta4",
"v6.0.0beta3",
"v6.0.0beta2",
"v6.0.0alpha2",
"v5.0.0",
"v5.0.0RC3",
"v5.0.0RC2",
"v5.0.0RC1",
"v5.0.0beta2",
"v5.0.0beta1",
"v5.0.0alpha1",
"v4.5.0",
"v4.5.0RC3",
"v4.5.0RC2",
"v4.5.0RC1",
"v4.5.0beta4",
"v4.5.0beta3",
"v4.0.6",
"v4.0.5",
"v4.0.4",
"v4.0.1",
"v4.0.0",
"v4.0.0RC2",
"v4.0.0RC",
"v4.0.0beta",
"v3.0",
"v1.0.0beta1"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-41239.json"
}
}
],
"modified": "2026-10-20T10:54:57.885951753Z",
"provider": "osv",
"references": [
"https://security.gentoo.org/glsa/202208-17",
"https://github.com/nextcloud/security-advisories/security/advisories/GHSA-g722-cm3h-8wrx",
"https://github.com/nextcloud/server/issues/27122",
"https://github.com/nextcloud/server/pull/29260"
],
"provider_metadata": {}
},
"related_cves": [
{
"value": "CVE-2021-41239",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 386569,
"published_at": "2022-03-08T18:15:07.873+00:00"
}