CVE-2021-22896

2021-06-1115:49:38

CWE-862

hackerone

www.cve.org

nextcloud

mail

access control

permission check

authenticated users

mail aliases

AI Score

4.8

Confidence

High

EPSS

0.001

Percentile

38.9%

JSON

Nextcloud Mail before 1.9.5 suffers from improper access control due to a missing permission check allowing other authenticated users to create mail aliases for other users.

CNA Affected

[
  {
    "product": "Nextcloud Mail",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Fixed in 1.9.5"
      }
    ]
  }
]