CVE-2026-45284 — MEDIUM (4.6)

Q: How severe is CVE-2026-45284?

CVE-2026-45284 has been rated MEDIUM with a CVSS base score of 4.6/10. Review the CVSS metrics above for detailed severity breakdown.

Q: Is there a patch for CVE-2026-45284?

Check the references section above for vendor advisories and patch information. Affected products include: Nextcloud User Oidc.

Vulnerability Description

Nextcloud is an open source content collaboration platform. From version 1.3.6 to before version 8.4.0, an improper check allowed users that where provided by LDAP to still authenticate towards user OIDC after they where deleted. This issue has been patched in version 8.4.0.

CVSS Score

4.6

MEDIUM

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality

LOW

Integrity

LOW

Availability

LOW

Affected Products

Vendor	Product	Versions
Nextcloud	User Oidc	>= 1.3.6, < 8.4.0

Related Weaknesses (CWE)

CWE-284

References

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-79xf-fMitigationVendor Advisory
https://github.com/nextcloud/user_oidc/pull/1340Issue TrackingPatch
https://hackerone.com/reports/3554696Permissions Required

FAQ

What is CVE-2026-45284?

CVE-2026-45284 is a vulnerability with a CVSS score of 4.6 (MEDIUM). Nextcloud is an open source content collaboration platform. From version 1.3.6 to before version 8.4.0, an improper check allowed users that where provided by LDAP to still authenticate towards user O...

How severe is CVE-2026-45284?

CVE-2026-45284 has been rated MEDIUM with a CVSS base score of 4.6/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-45284?

Check the references section above for vendor advisories and patch information. Affected products include: Nextcloud User Oidc.