CVE-2026-45284
📛 CVE Title
Nextcloud: Wrong condition in the User OIDC app's LdapService allowed deleted LDAP users to authenticate
Description
Nextcloud is an open source content collaboration platform. From version 1.3.6 to before version 8.4.0, an improper check allowed users that where provided by LDAP to still authenticate towards user OIDC after they where deleted. This issue has been patched in version 8.4.0.
Overview
- State
- PUBLISHED
- Assigner (CNA)
- GitHub_M
- CVSS severity
- MEDIUM
- CVSS score
- 4.6 / 10
- CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L- Effective score
- 4.6 / 10 MEDIUM source: CNA overview
- CWE(s)
-
CWE-284 - Reserved
- 2026-05-11
- Published
- 2026-06-01 16:57 UTC
- Last updated
- 2026-06-02 15:22 UTC
- Source
- https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/45xxx/CVE-2026-45284.json
- Linked Threat
- CVE-2026-45284 — CVE-2026-45284
NVD triage scoring NVD CVE 2.0
Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.
- NVD published
- 2026-06-01 19:16:50 UTC
- NVD last modified
- 2026-07-22 08:10:00 UTC
- NVD CVSS v3.1
- 4.6 / 10 MEDIUM source: security-advisories@github.com
- NVD CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L- Exploitability subscore
- 1.2 / 10
- Impact subscore
- 3.4 / 10
- EPSS score
- 0.0019 (probability of exploitation in next 30 days)
- EPSS percentile
- 9.31% vs all CVEs — higher = more likely to be exploited, as of 2026-07-27
NVD / KEV / EPSS data refreshed 2026-07-27 21:53 UTC. Re-run the 🛰 Backfill from NVD button above to refresh.
European Union Vulnerability Database ENISA EUVD
ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.
- EUVD ID
-
EUVD-2026-33710 - Assigner
- GitHub_M
- Published
- Jun 1, 2026, 4:57:56 PM
- Updated
- Jun 2, 2026, 3:22:21 PM
- EUVD base score (CVSS 3.1)
-
4.6 / 10
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L - EUVD-reported EPSS
- 0.1900
- Vendors
- nextcloud
- Products
-
security-advisories (1.3.6, < 8.4.0)
ENISA description: Nextcloud is an open source content collaboration platform. From version 1.3.6 to before version 8.4.0, an improper check allowed users that where provided by LDAP to still authenticate towards user OIDC after they where deleted. This issue has been patched in version 8.4.0.
Affected products (1)
| Vendor | Product | Versions | Platforms |
|---|---|---|---|
| nextcloud | security-advisories |
>= 1.3.6, < 8.4.0 (affected)
|
— |
Affected products — CPE 2.3 (1) NVD
NVD's normalized CPE 2.3 matchers, used by vendor tools (vulnerability scanners, asset managers) for automated detection. Compare with the CNA's free-text "Affected products" section above.
cpe:2.3:a:nextcloud:user_oidc:*:*:*:*:*:*:*:*
Vendor references (3)
References embedded in the original CVE record by the assigning CNA.
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-79xf-ffj8-96fm x_refsource_CONFIRM
- https://github.com/nextcloud/user_oidc/pull/1340 x_refsource_MISC
- https://hackerone.com/reports/3554696 x_refsource_MISC
Web references (6)
DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-79xf-ffj8-96fm tenable:github.com
- https://github.com/nextcloud/user_oidc/pull/1340 tenable:github.com
- https://hackerone.com/reports/3554696 tenable:hackerone.com
- https://nvd.nist.gov/vuln/detail/CVE-2026-45284 tenable:nvd.nist.gov
- https://www.cve.org/CVERecord?id=CVE-2026-45284 tenable:www.cve.org
- https://www.first.org/epss/ tenable:www.first.org
NVD-tagged references (3)
Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-79xf-ffj8-96fm security-advisories@github.com MitigationVendor Advisory
- https://github.com/nextcloud/user_oidc/pull/1340 security-advisories@github.com Issue TrackingPatch
- https://hackerone.com/reports/3554696 security-advisories@github.com Permissions Required
Remediations (20)
Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.
-
web:app.opencve.io
Nextcloud is an open source content collaboration platform. From version 1.3.6 to before version 8.4.0, an improper check allowed users that where provided by LDAP to still authenticate towards user OIDC after they where deleted. This issue has been patched in version 8.4.0. Show more Published: 2026 -06-01 Score:4.6 Medium EPSS:n/a KEV:No Impact:n/a Action:n/a Analysis
2026-06-08 15:50 UTC -
web:blogs.oracle.com
For more information about the Critical Patch Update program, see the security vulnerability remediation practices page located on the Oracle Trust Center.
2026-06-08 15:50 UTC -
web:cybersecuritynews.com
Microsoft's May 2026 Patch Tuesday lands with a heavy enterprise focus, fixing 120 vulnerabilities across Windows, Office, Azure, developer tools, and Microsoft 365 apps, including 29 remote code execution (RCE) flaws rated Critical.
2026-06-08 15:50 UTC -
web:layerlogix.com
April 2026 Patch Tuesday drops today. Here's what's critical, what to patch first, and how Houston IT teams should handle deployment — including the Secure Boot certificate deadline reminder.
2026-06-08 15:50 UTC -
web:op-c.net
CISA added two actively exploited Microsoft Defender vulnerabilities, CVE - 2026 -41091 and CVE - 2026 -45498, to its KEV catalog. Learn the risks and recommended actions.
2026-06-08 15:50 UTC -
web:portal.msrc.microsoft.com
The Security Update Guide provides information on the latest Microsoft security updates, helping users understand and address potential vulnerabilities effectively.
2026-06-08 15:50 UTC -
web:securityboulevard.com
Oracle addresses 241 CVEs in its second quarterly update of 2026 with 481 patches, including 34 critical updates.Key takeaways:The second Critical Patch Update (CPU) for 2026 contains fixes for 241 unique CVEs in 481 security updates 34 issues (7.1% of all patches) were assigned a critical severity rating Oracle Communications received the highest number of patches at 139, accounting for 28.9% ...
2026-06-08 15:50 UTC -
web:www.crowdstrike.com
Microsoft's April 2026 Patch Tuesday addresses 164 CVEs , featuring 8 Critical vulnerabilities, one exploited zero-day, and one disclosed zero-day.
2026-06-08 15:50 UTC -
web:www.securityweek.com
Oracle on Tuesday announced the release of 481 new security patches as part of its April 2026 Critical Patch Update (CPU). Across the 28 product families that received security updates, more than 300 patches address vulnerabilities that are remotely exploitable without authentication.
2026-06-08 15:50 UTC -
web:zecurit.com
Get the complete breakdown of Microsoft's June 2026 Patch Tuesday. We analyze the latest security updates and all critical CVEs .
2026-06-08 15:50 UTC -
web:blogs.oracle.com
For more information about the Critical Security Patch Update program, see the security vulnerability remediation practices page located on the Oracle Trust Center.
2026-06-19 02:32 UTC -
web:officialfixdessertchocolatier.com
Indulge in Dubai's viral chocolate bars with FIX Dessert Chocolatier. Shop our hero collection featuring Baklawa, Knafeh, Biscoff, and more. Fast delivery in Dubai & Abu Dhabi. Order now!
2026-06-19 02:32 UTC -
web:securitricks.com
CVE CVE-2026-45284 - Score : 4.6 - Source : security-advisories@github.com - Description : Nextcloud is an open source content collaboration platform. From version 1.3.6 to before version 8.4.0, an improper check allowed users that where provided by LDAP to still authenticate towards user OIDC after they where deleted. This issue has been patched in version 8.4.0. - Tags : CWE-284, security ...
2026-06-19 02:32 UTC -
web:support.microsoft.com
The Excel file also contains detailed fix lists. Download this Excel file now. Note: Individual entries in the following table can be referenced directly through a bookmark. If you select any bug reference ID in the table, a bookmark tag is added to the URL by using the "#bkmk_NNNNNNN" format.
2026-06-19 02:32 UTC -
web:techcommunity.microsoft.com
UPDATE June 9, 2026 : Please see our release blog post for June 2026 Security Update for more information on this CVE : Released: June 2026 Exchange Server Security Updates | Microsoft Community Hub. On May 14, 2026 , Microsoft disclosed CVE - 2026 -42897, a reported vulnerability affecting Exchange Outlook Web Access (OWA). An attacker could exploit this issue by sending a specially crafted email ...
2026-06-19 02:32 UTC -
web:vuln.today
Lifecycle Timeline 3 Patch available Jun 01, 2026 - 20:02 EUVD Source Code Evidence Fetched Jun 01, 2026 - 19:32 vuln.today Analysis Generated Jun 01, 2026 - 19:32 vuln.today
2026-06-19 02:32 UTC -
web:vulners.com
Nextcloud vulnerability CVE-2026-45284 affects the User OIDC LdapService in the Nextcloud platform. From version 1.3.6 up to, but not including, 8.4.0, an improper check allowed LDAP-authenticated users who had been deleted to continue authenticat...
2026-06-19 02:32 UTC -
web:www.cvefind.com
CVE Find is a cybersecurity intelligence platform indexing CVEs , CWEs, CAPEC, CVSS, EPSS and threat data. Search, track, and analyze known vulnerabilities and exploit risks.
2026-06-19 02:32 UTC -
web:www.oracle.com
Oracle Critical Patch Update Advisory - January 2026 Description A Critical Patch Update is a collection of patches for multiple security vulnerabilities. These patches address vulnerabilities in Oracle code and in third party components included in Oracle products. These patches are usually cumulative, but each advisory describes only the security patches added since the previous Critical ...
2026-06-19 02:32 UTC -
web:www.tenable.com
Nextcloud is an open source content collaboration platform. From version 1.3.6 to before version 8.4.0, an improper check allowed users that where provided by LDAP to still authenticate towards user OIDC after they where deleted. This issue has been patched in version 8.4.0.
2026-06-19 02:32 UTC
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.
Raw JSON
The full cvelistV5 record. Download as CVE-2026-45284.json.
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-45284",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-02T15:21:53.007287Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-02T15:22:21.264Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "security-advisories",
"vendor": "nextcloud",
"versions": [
{
"status": "affected",
"version": ">= 1.3.6, < 8.4.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Nextcloud is an open source content collaboration platform. From version 1.3.6 to before version 8.4.0, an improper check allowed users that where provided by LDAP to still authenticate towards user OIDC after they where deleted. This issue has been patched in version 8.4.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 4.6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284: Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-01T16:57:56.210Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-79xf-ffj8-96fm",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-79xf-ffj8-96fm"
},
{
"name": "https://github.com/nextcloud/user_oidc/pull/1340",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/nextcloud/user_oidc/pull/1340"
},
{
"name": "https://hackerone.com/reports/3554696",
"tags": [
"x_refsource_MISC"
],
"url": "https://hackerone.com/reports/3554696"
}
],
"source": {
"advisory": "GHSA-79xf-ffj8-96fm",
"discovery": "UNKNOWN"
},
"title": "Nextcloud: Wrong condition in the User OIDC app's LdapService allowed deleted LDAP users to authenticate"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-45284",
"datePublished": "2026-06-01T16:57:56.210Z",
"dateReserved": "2026-05-11T18:41:13.158Z",
"dateUpdated": "2026-06-02T15:22:21.264Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}