Nextcloud · Nextcloud Talk · CVE-2021-41179
**Name of the Vulnerable Software and Affected Versions**
Nextcloud Server versions prior to 20.0.13
Nextcloud Server versions prior to 21.0.5
Nextcloud Server versions prior to 22.2.0
**Description**
Nextcloud is an open-source, self-hosted productivity platform. The Two-Factor Authentication wasn't enforced for pages marked as `@PublicPage`. This could be leveraged to gain access to any private chat channel without going through the Two-Factor flow, particularly affecting the Nextcloud Talk application.
**Recommendations**
For versions prior to 20.0.13, upgrade to 20.0.13.
For versions prior to 21.0.5, upgrade to 21.0.5.
For versions prior to 22.2.0, upgrade to 22.2.0.
As a temporary workaround, consider restricting access to pages marked as `@PublicPage` until the issue is resolved.