CVE-2021-32665 - CVE House
Back to Database
Status published High CVE-2021-32665

Verified groups not reliable

Vulnerability Description

wire-ios is the iOS version of Wire, an open-source secure messaging app. wire-ios versions 3.8.0 and earlier have a bug in which a conversation could be incorrectly set to "unverified. This occurs when: - Self user is added to a new conversation - Self user is added to an existing conversation - All the participants in the conversation were previously marked as verified. The vulnerability is patched in wire-ios version 3.8.1. As a workaround, one can unverify & verify a device in the conversation.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-32665

Credits & Attribution

No credits recorded in the NVD database.

References

More from wireapp

View All →
CVE-2025-49846
wire-ios accidentally logs message contents
Medium 4.1
CVE-2025-48066
wire-webapp has no database deletion on client logout
Medium 6
CVE-2025-48061
wire-webapp Has Insufficient Session Invalidation after User Logout
Medium 5.6
CVE-2023-48221
wire-avs remote format string vulnerability
High 7.3
CVE-2023-22737
wire-server vulnerable to unauthorized removal of Bots from Conversations
Medium 6.5

Affected Vendor

Affected Software

wire-ios
Vulnerable Versions:
<= 3.8.0

Timeline

Official Publish: June 3rd, 2021
Last Modified: August 3rd, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-345

MITRE ATT&CK TTPs

T1557 Adversary-in-the-Middle
Credential Access
T1071 Application Layer Protocol
Command and Control
T1552 Unsecured Credentials
Credential Access
T1190 Exploit Public-Facing Application
Initial Access
T1041 Exfiltration Over C2 Channel
Exfiltration