CVE-2021-41241 Advanced permissions is not respected for subfolders in Nextcloud server

Medium 4.3 Published 8 Mar 2022 Updated 23 Apr 2025

Users can bypass advanced permission restrictions on subfolders in Nextcloud groupfolders by copying the folder, allowing unauthorized data access.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2021-41241?

CVE-2021-41241 is a medium-severity missing authorization vulnerability in Nextcloud Nextcloud Server, published on 8 Mar 2022. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Nextcloud server is a self hosted system designed to provide cloud style services. The groupfolders application for Nextcloud allows sharing a folder with a group of people. In addition, it allows setting "advanced permissions" on subfolders, for example, a user could be granted access to the groupfolder but not specific subfolders. Due to a lacking permission check in affected versions, a user could still access these subfolders by copying the groupfolder to another location. It is recommended that the Nextcloud Server is upgraded to 20.0.14, 21.0.6 or 22.2.1. Users unable to upgrade should disable the "groupfolders" application in the admin settings.

Weakness: CWE-862, CWE-863

Which versions are affected by CVE-2021-41241?

It affects 1 product.

Products include Nextcloud Nextcloud Server.

How do I fix CVE-2021-41241?

Upgrade to a fixed version.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2021-41241 being exploited?

There is no known exploitation of CVE-2021-41241 in the wild and no public exploit code.

All Nextcloud Nextcloud Server vulnerabilities

Sources

Also known as GHSA-m4wp-r357-4q94.