What is the CVSS score of CVE-2026-45284?

CVE-2026-45284 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Nextcloud user_oidc are affected by CVE-2026-45284?

A defect in the Nextcloud OpenID Connect plugin fails to revoke access when user accounts are deleted from LDAP, allowing de-provisioned employees with valid OpenID credentials to retain platform…. A patch is available.

How to fix or mitigate CVE-2026-45284?

Within 24 hours, identify all Nextcloud instances using the user_oidc app and confirm which versions are deployed; any instance running versions 1.3.6 through 8.3.9 requires immediate patch priority. Within 7 days, deploy vendor-released patch version 8.4.0 to all affected installations and verify the LDAP-OIDC integration functions properly post-deployment. Within 30 days, audit access logs spanning the past 90 days to identify any re-authentication attempts by deleted user accounts, validate that OIDC credentials are revoked upon user deletion in LDAP, and document the remediation in your identity and access management audit trail.

Nextcloud user_oidc CVE-2026-45284

EUVD-2026-33710 HIGH

Improper Access Control (CWE-284)

2026-06-01 GitHub_M

Authentication Bypass Nextcloud Security Advisories

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Network OIDC login with the deleted user's own credentials gives PR:L and AC:L; regained account access yields high confidentiality and integrity impact but no availability impact, so A:N.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Jul 22, 2026 - 08:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 22, 2026 - 08:22 vuln.today

cvss_changed

Severity Changed

Jul 22, 2026 - 08:22 NVD

MEDIUM HIGH

CVSS changed

Jul 22, 2026 - 08:22 NVD

4.6 (MEDIUM) 8.8 (HIGH)

Patch available

Jun 01, 2026 - 20:02 EUVD

Source Code Evidence Fetched

Jun 01, 2026 - 19:32 vuln.today

Analysis Generated

Jun 01, 2026 - 19:32 vuln.today

DescriptionNVD

Nextcloud is an open source content collaboration platform. From version 1.3.6 to before version 8.4.0, an improper check allowed users that where provided by LDAP to still authenticate towards user OIDC after they where deleted. This issue has been patched in version 8.4.0.

AnalysisAI

Authentication bypass in the Nextcloud user_oidc app (versions 1.3.6 up to but not including 8.4.0) lets users that were originally provisioned via LDAP continue to authenticate through OpenID Connect even after their account has been deleted. Because an internal LDAP-enabled check was inverted, deletion did not correctly revoke OIDC login for affected accounts, meaning a de-provisioned user with valid OIDC credentials could regain access to the platform. There is no public exploit identified at time of analysis and EPSS is very low (0.03%), but the flaw is a genuine access-control gap fixed in version 8.4.0.

Technical ContextAI

Nextcloud is a self-hosted content-collaboration platform, and user_oidc is its official app for delegating authentication to an external OpenID Connect identity provider. Deployments frequently combine LDAP-based user provisioning with OIDC single sign-on. The root cause is CWE-284 (Improper Access Control): as shown in the PR #1340 diff for lib/Service/LdapService.php, the condition guarding LDAP-user handling was inverted (if ($this->isLDAPEnabled()) corrected to if (!$this->isLDAPEnabled())). This logic error meant the code path that should have blocked or re-evaluated an LDAP-sourced account after deletion did not execute correctly, so the OIDC login flow still treated the deleted identity as valid. The advisory-tracked CPE (cpe:2.3:a:nextcloud:security-advisories) is an artifact of Nextcloud's security-advisories repository rather than the true package identifier; the actually affected component is the user_oidc app.

RemediationAI

Vendor-released patch: upgrade the Nextcloud user_oidc app to version 8.4.0 or later, which corrects the inverted LDAP-enabled check per PR #1340 (https://github.com/nextcloud/user_oidc/pull/1340) and advisory GHSA-79xf-ffj8-96fm (https://github.com/nextcloud/security-advisories/security/advisories/GHSA-79xf-ffj8-96fm). Until 8.4.0 can be deployed, compensating controls include disabling the user_oidc login flow for LDAP-provisioned users, or handling offboarding at the identity-provider layer by revoking or disabling the account/tokens directly in the OIDC IdP (so authentication fails upstream regardless of Nextcloud's local state) - the trade-off is added IdP administrative overhead and that it only protects accounts you explicitly revoke. Administrators should also audit recent OIDC logins for accounts that were deleted to detect any post-deletion access. Do not rely on Nextcloud account deletion alone as the revocation mechanism on affected versions.