CVE-2021-32726CWE-708

Webauthn tokens not removed after user has been deleted

High · published July 12, 2021

CVSS v3.1
7.1
EPSS
2%
Percentile
78.1
In the wild
Unconfirmed
What it is

Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, webauthn tokens were not deleted after a user has been deleted. If a victim reused an earlier used username, the previous user could gain access to their account. The issue was fixed in versions 19.0.13, 20.0.11, and 21.0.3. There are no known workarounds.

The record
Technical detail
CVSS v3.1
7.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01779 · 78.1th percentile
Weakness
CWE-708 · Incorrect Ownership Assignment
Published
2021-07-12T19:45Z
EPSS history
Timeline
  • 12 JUL 19:45Z
    Webauthn tokens not removed after user has been deleted
    cvelistv5