CVE-2021-32728

CVE-2021-32728 is a medium-severity vulnerability affecting Nextcloud Desktop Client versions prior to 3.3.0, specifically impacting its end-to-end encryption feature. The client failed to verify if a downloaded private key corresponded to a previously obtained public certificate, allowing a malicious Nextcloud instance to serve a rogue public key. This could lead to data being encrypted for the attacker's key, compromising confidentiality. The vulnerability has a CVSS score of 6.5 (MEDIUM) with a network attack vector and low complexity, requiring user authentication but no user interaction. There is no evidence of active exploitation, public exploit code, or significant community discussion, and it is not listed in CISA's KEV catalog.