CVE-2024-37312

MEDIUM

Nextcloud User Oidc < 5.0.0 - Improper Access Control

Title source: rule

Description

user_oidc app is an OpenID Connect user backend for Nextcloud. Missing access control on the ID4me endpoint allows an attacker to register an account eventually getting access to data that is available to all registered users. It is recommended that the OpenID Connect user backend is upgraded to 3.0.0 (Nextcloud 20-23), 4.0.0 (Nexcloud 24) or 5.0.0 (Nextcloud 25-28).

References (3)

Scores

CVSS v3 6.3
EPSS 0.0047
EPSS Percentile 64.1%
Attack Vector ADJACENT_NETWORK
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Classification

CWE
CWE-284
Status published

Affected Products (1)

nextcloud/user_oidc < 5.0.0

Timeline

Published Jun 14, 2024
Tracked Since Feb 18, 2026