CVE-2021-32678

🗓️ 12 Jul 2021 12:25:11Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 3 Media mentions👁 182 Views

Nextcloud Server OCS API responses prior to 19.0.13, 20.0.11, 21.0.3 don't apply ratelimits. Risk includes bypassing authentication ratelimits or spamming users. Patches available in mentioned versions

Reporter	Title	Published	Views	Family All 45
ATTACKERKB	CVE-2021-32678	12 Jul 202113:15	–	attackerkb
ArchLinux	[ASA-202107-22] nextcloud: multiple issues	14 Jul 202100:00	–	archlinux
Circl	CVE-2021-32678	12 Jul 202116:17	–	circl
CNNVD	Nextcloud 安全漏洞	12 Jul 202100:00	–	cnnvd
CNVD	Unspecified Vulnerability in Nextcloud (CNVD-2021-51810)	15 Jul 202100:00	–	cnvd
Cvelist	CVE-2021-32678 Ratelimit not applied on OCS API responses	12 Jul 202112:25	–	cvelist
EUVD	EUVD-2021-19486	7 Oct 202500:30	–	euvd
Fedora	[SECURITY] Fedora 33 Update: nextcloud-19.0.13-1.fc33	22 Jul 202101:16	–	fedora
Fedora	[SECURITY] Fedora 34 Update: nextcloud-20.0.11-1.fc34	22 Jul 202101:14	–	fedora
Tenable Nessus	GLSA-202208-17 : Nextcloud: Multiple Vulnerabilities	16 Aug 202200:00	–	nessus

NVD

Vulners

Node

nextcloud nextcloud_serverRange<19.0.13

nextcloud nextcloud_serverRange20.0.0–20.0.11

nextcloud nextcloud_serverRange21.0.0–21.0.3

Node

fedoraproject fedoraMatch33

fedoraproject fedoraMatch34

[
  {
    "product": "security-advisories",
    "vendor": "nextcloud",
    "versions": [
      {
        "status": "affected",
        "version": "< 19.0.13"
      },
      {
        "status": "affected",
        "version": ">= 20.0.0, < 20.0.11"
      },
      {
        "status": "affected",
        "version": ">= 21.0.0, < 21.0.3"
      }
    ]
  }
]

Source	Link
lists	www.lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J63NBVPR2AQCAWRNDOZSGRY5II4WS2CZ/
github	www.github.com/nextcloud/security-advisories/security/advisories/GHSA-48rx-3gmf-g74j
github	www.github.com/nextcloud/server/pull/27329
security	www.security.gentoo.org/glsa/202208-17
lists	www.lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BVZS26RDME2DYTKET5AECRIZDFUGR2AZ/
hackerone	www.hackerone.com/reports/1214158

17 Jun 2026 03:53Current

5Medium risk

Vulners AI Score5

CVSS 25

CVSS 3.13.7 - 5.3

EPSS0.01374