CVE-2021-32726 Webauthn tokens not removed after user has been deleted

2021-07-1219:45:13

CWE-708

GitHub_M

www.cve.org

nextcloud

webauthn

tokens

vulnerability

user deletion

access

fix

versions

CVSS3

7.1

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

AI Score

9.6

Confidence

High

EPSS

0.003

Percentile

71.2%

JSON

Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, webauthn tokens were not deleted after a user has been deleted. If a victim reused an earlier used username, the previous user could gain access to their account. The issue was fixed in versions 19.0.13, 20.0.11, and 21.0.3. There are no known workarounds.

CNA Affected

[
  {
    "product": "security-advisories",
    "vendor": "nextcloud",
    "versions": [
      {
        "status": "affected",
        "version": "< 19.0.13"
      },
      {
        "status": "affected",
        "version": ">= 20.0.0, < 20.0.11"
      },
      {
        "status": "affected",
        "version": ">= 21.0.0, < 21.0.3"
      }
    ]
  }
]