PatchTheCVECVE-2021-41256: nextcloud news-android is an Android client for the Nextcloud news/feed reader app
CVE-2021-41256 is a medium-severity flaw (CVSS 5.8) affecting news. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
nextcloud news-android is an Android client for the Nextcloud news/feed reader app. In affected versions the Nextcloud News for Android app has a security issue by which a malicious application installed on the same device can send it an arbitrary Intent that gets reflected back, unintentionally giving read and write access to non-exported Content Providers in Nextcloud News for Android. Users should upgrade to version 0.9.9.63 or higher as soon
Why this priority
- Public exploit reference
A fixed release or distro patch exists.
Risk facts
| CVSS score | 5.8 (Medium) |
| Attack vector | Local |
| Attack complexity | Low |
| Privileges needed | High |
| User interaction | Required |
| EPSS exploit chance | 1.1% (top 34%) |
| CISA exploited list | No |
| Weakness | CWE-829 |
| Published | 2021-11-30 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2021-41256?
news: upgrade to 0.9.9.63. Exact commands for each OS are on this page.
Is CVE-2021-41256 being exploited?
CVE-2021-41256 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2021-41256 affect?
CVE-2021-41256 affects news. Severity is medium (CVSS 5.8). nextcloud news-android is an Android client for the Nextcloud news/feed reader app. In affected versions the Nextcloud News for Android app has a security issue by which a malicious application installed on the same device can send it an ar
How urgent is CVE-2021-41256?
Priority 42/100. Public exploit reference
Software pages
Android vulnerabilities · Nextcloud vulnerabilities
Related CVEs
- CVE-2019-12724 MEDIUM 6.1 UPGRADE An issue was discovered in the Teclib News plugin through 1.5.2 for GLPI
- CVE-2017-15982 CRITICAL 9.8 DOWNGRADE Dynamic News Magazine & Blog CMS 1.0 allows SQL Injection via the id parameter to admin/admin_process.php for
- CVE-2014-6290 HIGH 7.5 UPGRADE The News (tt_news) extension before 3.5.2 for TYPO3 allows remote attackers to have unspecified impact via vec
- CVE-2013-4748 HIGH 7.5 UPGRADE SQL injection vulnerability in the News system (news) extension before 1.3.3 for TYPO3 allows remote attackers
- CVE-2011-3851 MEDIUM 4.3 UPGRADE Cross-site scripting (XSS) vulnerability in the News theme before 0.2 for WordPress allows remote attackers to