Nextcloud user_oidc CVE-2026-45284

Exploitation requires that the Nextcloud instance runs the user_oidc app (version 1.3.6 to before 8.4.0) with OpenID Connect login enabled AND uses LDAP to provision users; the target account must have been an LDAP-provided user that was subsequently deleted, and the attacker must possess that account's valid OIDC credentials at the identity provider. What limits exploitation: it only affects LDAP-originated accounts (not native or pure-OIDC users), it depends on this specific LDAP+OIDC deployment mode rather than a default single-source configuration, the attacker cannot target arbitrary accounts (only a de-provisioned identity they already control credentials for), and the impact is confined to regaining that one user's level of access rather than privilege escalation.

The CVSS 3.1 base score is 8.8 (AV:N/AC:L/PR:L/UI:N/C:H/I:H/A:H), reflecting network reachability, low complexity, and high impact, but the required privilege (PR:L) signals that the attacker must already hold valid OIDC credentials tied to a specific, previously-provisioned-then-deleted account - this is not open unauthenticated compromise. Corroborating softer signals point to lower real-world urgency: EPSS is only 0.03% (9th percentile), CISA SSVC records Exploitation: none, Automatable: no, and Technical Impact: partial, and the issue is not in CISA KEV. These signals are consistent rather than conflicting: high potential impact but narrow, non-automatable, credentialed preconditions. The practical priority is moderate - important for organizations that use LDAP-to-OIDC provisioning and rely on account deletion as a security control (offboarding), but low for deployments not running user_oidc or not deleting LDAP users.

An employee who was provisioned into Nextcloud via LDAP is offboarded and their account deleted, but they retain valid credentials at the organization's OIDC identity provider. On an affected user_oidc version they simply log in again through the OIDC flow and are granted access to the platform and their prior data despite the deletion. No public proof-of-concept is known, and the network-facing, low-complexity flow requires only the deleted user's own OIDC credentials.