CVE-2021-22905: 
NixOS vulnerability analysis and mitigation

The vulnerability (CVE-2021-22905) affects the Nextcloud Android App (com.nextcloud.client) versions prior to v3.16.0. The vulnerability involves information disclosure where searches for sharees are performed by default on the lookup server instead of only using the local Nextcloud server, unless a global search has been explicitly chosen by the user (Nextcloud Advisory).

The vulnerability is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The CVSS v3.1 base score is 6.5 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, indicating network accessibility, low attack complexity, no privileges required, user interaction required, unchanged scope, high confidentiality impact, and no impact on integrity or availability (NVD).

The vulnerability leads to information disclosure by performing sharee searches on the lookup server by default, potentially exposing user search data beyond the intended local Nextcloud server scope (Nextcloud Advisory).

The vulnerability requires user interaction but no special privileges for exploitation. The attack vector is network-accessible, making it potentially exploitable from remote locations (NVD).

The vulnerability has been patched in Nextcloud Android App version 3.16.0. No workarounds are available, and users are recommended to upgrade to the patched version (Nextcloud Advisory).