CVE-2021-32726 is a critical vulnerability affecting Nextcloud Server versions prior to 19.0.13, 20.0.11, and 21.0.3. It arises because WebAuthn tokens were not properly deleted when a user account was removed. This oversight could allow a previous user to gain unauthorized access to an account if their old username was subsequently reused by a new user. The vulnerability carries a CVSS score of 9.8 (Critical), indicating a severe risk. It is easily exploitable over the network with low attack complexity and no user interaction required, potentially leading to complete compromise of confidentiality, integrity, and availability. Currently, there is no evidence of active exploitation, nor is exploit code publicly available in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are minimal, suggesting low public awareness despite its critical severity.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 19.0.13CPE matchmatch criteria | cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:*:*:*:* | ||
>= 20.0.0, < 20.0.11CPE matchmatch criteria | cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:*:*:*:* | ||
>= 21.0.0, < 21.0.3CPE matchmatch criteria | cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.