CVE-2021-32726

Webauthn tokens not removed after user has been deleted

State: Published
Severity: 7.1 High
Published: Jul 12, 2021
Updated: Aug 3, 2024
Reserved: May 12, 2021

Description

Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, webauthn tokens were not deleted after a user has been deleted. If a victim reused an earlier used username, the previous user could gain access to their account. The issue was fixed in versions 19.0.13, 20.0.11, and 21.0.3. There are no known workarounds.

Scores

CVSS	Score	Vector	Source
3.1	7.1 High	CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H	GitHub_M

Weaknesses

CWE-708 Incorrect Ownership Assignment

Affected Products

Product	Versions
security-advisoriesnextcloud	< 19.0.13Affected >= 20.0.0, < 20.0.11Affected >= 21.0.0, < 21.0.3Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.