Skip to content
Heist/ feed
Back to feed
Medium

Security advisory

Type: advisorySources: OSVCVE: CVE-2021-32678

Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.0.11, and 21.0.3, ratelimits are not applied to OCS API responses. This affects any OCS API controller (`OCSController`) using the `@BruteForceProtection` annotation. Risk depends on the installed applications on the Nextcloud Server, but could range from bypassing authentication ratelimits or spamming other Nextcloud users. The vulnerability is patched in versions 19.0.13, 20.0.11, and 21.0.3. No workarounds aside from upgrading are known to exist.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2021-32678
Confirmed fixed CVEs
Not specified
Updated in this feed
31 Oct 2026, 11:46 UTC · Revision 1

Source evidence

CVE-2021-32678

core-osv · Original source

Published 12 Jul 2021, 13:15 UTC

Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.0.11, and 21.0.3, ratelimits are not applied to OCS API responses. This affects any OCS API controller (`OCSController`) using the `@BruteForceProtection` annotation. Risk depends on the installed applications on the Nextcloud Server, but could range from bypassing authentication ratelimits or spamming other Nextcloud users. The vulnerability is patched in versions 19.0.13, 20.0.11, and 21.0.3. No workarounds aside from upgrading are known to exist.

osv:CVE-2021-32678
Complete source record
{
  "id": "b407e065e8c6516674b26795a3236a08dad0bfd3779e77be3c3bbefa97302bad",
  "url": "https://osv.dev/vulnerability/CVE-2021-32678",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "CVE-2021-32678",
    "summary": "Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.0.11, and 21.0.3, ratelimits are not applied to OCS API responses. This affects any OCS API controller (`OCSController`) using the `@BruteForceProtection` annotation. Risk depends on the installed applications on the Nextcloud Server, but could range from bypassing authentication ratelimits or spamming other Nextcloud users. The vulnerability is patched in versions 19.0.13, 20.0.11, and 21.0.3. No workarounds aside from upgrading are known to exist.",
    "evidence": "osv:CVE-2021-32678",
    "products": [],
    "severity": "medium",
    "structured": {
      "id": "CVE-2021-32678",
      "aliases": [
        "CVE-2021-32678",
        "GHSA-48rx-3gmf-g74j"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/nextcloud/server",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "3845aa47869e6787bf9b25cae59f9b999c6f7807"
                },
                {
                  "introduced": "615b994816710a595243d704c9be445f736b4b41"
                },
                {
                  "fixed": "3eb0ce9892933c36672e8ba35e771e48a5309321"
                },
                {
                  "introduced": "8985b7930653139859002eb3eca2852999ed8f0d"
                },
                {
                  "fixed": "5d04a3fed226c370feca686032f47d5422b02bb2"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "cpe": "cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:*:*:*:*",
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "19.0.13"
                      }
                    ],
                    "source": "CPE_RANGE"
                  },
                  {
                    "cpe": "cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:*:*:*:*",
                    "range": [
                      {
                        "introduced": "20.0.0"
                      },
                      {
                        "fixed": "20.0.11"
                      }
                    ],
                    "source": "CPE_RANGE"
                  },
                  {
                    "cpe": "cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:*:*:*:*",
                    "range": [
                      {
                        "introduced": "21.0.0"
                      },
                      {
                        "fixed": "21.0.3"
                      }
                    ],
                    "source": "CPE_RANGE"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v19.0.13rc1",
            "v21.0.3rc1",
            "v20.0.11rc1",
            "v19.0.11",
            "v20.0.10",
            "v21.0.2",
            "v19.0.11RC1",
            "v20.0.10RC1",
            "v21.0.2RC1",
            "v19.0.10",
            "v20.0.9",
            "v21.0.1",
            "v19.0.10RC1",
            "v21.0.1RC1",
            "v20.0.9RC1",
            "v19.0.9",
            "v20.0.8",
            "v21.0.0",
            "v19.0.9RC1",
            "v20.0.8RC1",
            "v20.0.7RC1",
            "v20.0.7",
            "v19.0.8",
            "v20.0.6",
            "v19.0.8RC1",
            "v20.0.6RC1",
            "v19.0.7",
            "v20.0.5",
            "v20.0.5RC2",
            "v19.0.7RC1",
            "v20.0.5RC1",
            "v20.0.4",
            "v19.0.6",
            "v20.0.3",
            "v19.0.6RC2",
            "v20.0.3RC2",
            "v19.0.5",
            "v20.0.2",
            "v19.0.5RC2",
            "v20.0.2RC2",
            "v19.0.5RC1",
            "v20.0.2RC1",
            "v20.0.1",
            "v20.0.1RC1",
            "v19.0.4",
            "v19.0.4RC2",
            "v20.0.0",
            "v19.0.40RC1",
            "v19.0.3",
            "v19.0.3RC1",
            "v19.0.2",
            "v19.0.2RC2",
            "v19.0.2RC1",
            "v19.0.1",
            "v19.0.1RC1",
            "v19.0.0",
            "v19.0.0RC3",
            "v19.0.0RC1",
            "v19.0.0beta7",
            "v19.0.0beta6",
            "v19.0.0beta5",
            "v19.0.0beta4",
            "v19.0.0beta3",
            "v19.0.0beta2",
            "v19.0.0beta1",
            "v18.0.0RC1",
            "v18.0.0beta4",
            "v18.0.0beta3",
            "v18.0.0beta2",
            "v18.0.0beta1",
            "v17.0.0beta4",
            "v17.0.0beta3",
            "v17.0.0beta2",
            "v17.0.0beta1",
            "v16.0.0RC1",
            "v16.0.0beta3",
            "v16.0.0beta2",
            "v16.0.0beta1",
            "v16.0.0alpha1",
            "v15.0.0RC1",
            "v15.0.0beta2",
            "v15.0.0beta1",
            "v14.0.0RC2",
            "v14.0.0RC1",
            "v14.0.0beta4",
            "v14.0.0beta3",
            "v14.0.0beta2",
            "v14.0.0beta1",
            "v13.0.0RC1",
            "v13.0.0beta4",
            "v13.0.0beta3",
            "v13.0.0beta2",
            "v13.0.0beta1",
            "v12.0.0beta4",
            "v12.0.0beta3",
            "v12.0.0beta2",
            "v12.0.0beta1",
            "v11.0.0",
            "v11.0RC2",
            "v9.1.0beta1",
            "v9.0.0beta2",
            "v9.0beta1",
            "v8.2RC1",
            "v8.2beta1",
            "v8.1RC2",
            "v8.1.0beta2",
            "v8.1.0beta1",
            "v8.1.0alpha2",
            "v8.1.0alpha1",
            "v8.0.0",
            "v8.0.0RC2",
            "v8.0.0RC1",
            "v8.0.0beta2",
            "v8.0.0beta1",
            "v8.0.0alpha2",
            "v8.0.0alpha1",
            "v7.0.0beta1",
            "v7.0.0alpha2",
            "v6.0.0RC2",
            "v6.0.0RC1",
            "v6.0.0beta5",
            "v6.0.0beta4",
            "v6.0.0beta3",
            "v6.0.0beta2",
            "v6.0.0alpha2",
            "v5.0.0",
            "v5.0.0RC3",
            "v5.0.0RC2",
            "v5.0.0RC1",
            "v5.0.0beta2",
            "v5.0.0beta1",
            "v5.0.0alpha1",
            "v4.5.0",
            "v4.5.0RC3",
            "v4.5.0RC2",
            "v4.5.0RC1",
            "v4.5.0beta4",
            "v4.5.0beta3",
            "v4.0.6",
            "v4.0.5",
            "v4.0.4",
            "v4.0.1",
            "v4.0.0",
            "v4.0.0RC2",
            "v4.0.0RC",
            "v4.0.0beta",
            "v3.0",
            "v1.0.0beta1"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-32678.json"
          }
        }
      ],
      "modified": "2026-10-20T10:54:42.136846567Z",
      "provider": "osv",
      "references": [
        "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BVZS26RDME2DYTKET5AECRIZDFUGR2AZ/",
        "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J63NBVPR2AQCAWRNDOZSGRY5II4WS2CZ/",
        "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-48rx-3gmf-g74j",
        "https://security.gentoo.org/glsa/202208-17",
        "https://hackerone.com/reports/1214158",
        "https://github.com/nextcloud/server/pull/27329"
      ],
      "provider_metadata": {
        "unresolved_ranges": [
          {
            "cpes": [
              "cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*",
              "cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*"
            ],
            "vendor_product": "fedoraproject:fedora",
            "extracted_events": [
              {
                "range": [
                  {
                    "introduced": "33"
                  },
                  {
                    "last_affected": "33"
                  },
                  {
                    "introduced": "34"
                  },
                  {
                    "last_affected": "34"
                  }
                ],
                "source": "CPE_STRING"
              }
            ]
          }
        ]
      }
    },
    "related_cves": [
      {
        "value": "CVE-2021-32678",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 385929,
  "published_at": "2021-07-12T13:15:07.923+00:00"
}