CVE-2026-45284CWE-284

Nextcloud: Wrong condition in the User OIDC app's LdapService allowed deleted LDAP users to authenticate

Medium · published June 1, 2026

CVSS v3.1
4.6
EPSS
0%
Percentile
28.9
In the wild
Unconfirmed
What it is

Nextcloud is an open source content collaboration platform. From version 1.3.6 to before version 8.4.0, an improper check allowed users that where provided by LDAP to still authenticate towards user OIDC after they where deleted. This issue has been patched in version 8.4.0.

The record
Technical detail
CVSS v3.1
4.6 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00363 · 28.9th percentile
Weakness
CWE-284 · Improper Access Control
Published
2026-06-01T16:57Z
EPSS history
Timeline
  • 01 JUN 16:57Z
    Nextcloud: Wrong condition in the User OIDC app's LdapService allowed deleted LDAP users to authenticate
    cvelistv5