CVE-2021-32726 HIGH

CVE-2021-32726: Webauthn tokens not removed after user has been deleted

Vendor Nextcloud
Product security-advisories
Weakness CWE-708
Published July 12, 2021
Last update August 3, 2024
View on NVD All CVEs

CVSS base score

7.1/10
Attack vector Network
Attack complexity High
Privileges required Low
User interaction Required
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, webauthn tokens were not deleted after a user has been deleted. If a victim reused an earlier used username, the previous user could gain access to their account. The issue was fixed in versions 19.0.13, 20.0.11, and 21.0.3. There are no known workarounds.

Key dates

02Disclosure timeline

July 12, 2021 CVE published
August 3, 2024 Record updated