What is the CVSS score of CVE-2026-45284?

CVE-2026-45284 has a CVSS 3.1 base score of 4.6 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-45284?

Yes, a patch is available for CVE-2026-45284. Update the affected software to the latest version immediately.

Nextcloud user_oidc CVE-2026-45284

EUVD-2026-33710 MEDIUM

Improper Access Control (CWE-284)

2026-06-01 GitHub_M

Authentication Bypass Nextcloud

4.6

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

4.6 MEDIUM

AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Patch available

Jun 01, 2026 - 20:02 EUVD

Source Code Evidence Fetched

Jun 01, 2026 - 19:32 vuln.today

Analysis Generated

Jun 01, 2026 - 19:32 vuln.today

DescriptionGitHub Advisory

Nextcloud is an open source content collaboration platform. From version 1.3.6 to before version 8.4.0, an improper check allowed users that where provided by LDAP to still authenticate towards user OIDC after they where deleted. This issue has been patched in version 8.4.0.

AnalysisAI

Authentication bypass in Nextcloud's user_oidc app (versions 1.3.6 through 8.3.x) allows users deleted from LDAP to continue authenticating via OpenID Connect. The root cause is a boolean logic inversion in LdapService.php - the condition isLDAPEnabled() was used instead of !isLDAPEnabled(), causing the LDAP deletion check to execute only when LDAP was inactive, effectively skipping it in every real-world deployment. No public exploit code has been identified at time of analysis; the issue was responsibly disclosed via HackerOne report #3554696.

Technical ContextAI

The vulnerability resides in the user_oidc Nextcloud application (CPE: cpe:2.3:a:nextcloud:security-advisories), which integrates OpenID Connect single sign-on with Nextcloud's LDAP user provisioning backend. CWE-284 (Improper Access Control) describes the class of failure precisely: the access control gate responsible for enforcing LDAP account lifecycle - specifically, user deletion - was rendered non-functional by a single inverted boolean in lib/Service/LdapService.php. The diff from GitHub PR #1340 shows the entire fix is changing if ($this->isLDAPEnabled()) to if (!$this->isLDAPEnabled()), meaning that prior to the patch, the deletion-enforcement block was entered only when LDAP was disabled, leaving deleted LDAP users entirely unchecked during OIDC authentication flows when LDAP was active.

RemediationAI

Upgrade the Nextcloud user_oidc app to version 8.4.0, the vendor-released patch confirmed by GitHub PR #1340 (https://github.com/nextcloud/user_oidc/pull/1340) and security advisory GHSA-79xf-ffj8-96fm. As a temporary compensating control, administrators may disable the user_oidc app entirely and revert to LDAP-native authentication flows; this eliminates the vulnerable code path but disrupts OIDC-based SSO for all users. A narrower mitigation is to audit active OIDC sessions and forcibly invalidate sessions belonging to accounts recently removed from LDAP - this reduces exposure without full service disruption but requires manual or scripted session management. There is no known configuration flag to enable correct deletion-check behavior without applying the patch; the flaw is in application logic, not a configurable parameter.