CVE-2021-22896: Nextcloud

Medium severity, CVSS 4.3. EPSS: 1% chance of exploitation in the next 30 days.

Nextcloud Mail before 1.9.5 suffers from improper access control due to a missing permission check allowing other authenticated users to create mail aliases for other users.

Affected products

• Nextcloud Nextcloud: before 1.9.5 (fixed in 1.9.5)

Published 2021-06-11. Last modified 2026-06-17.