CVE-2021-32726: Webauthn tokens not removed after user has been deleted
Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, webauthn tokens were not deleted after a user has been deleted. If a victim reused an earlier used username, the previous user could gain access to their account. The issue was fixed in versions 19.0.13, 20.0.11, and 21.0.3. There are no known workarounds.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2021-32726?
CVE-2021-32726 has a medium severity level as it allows unauthorized access to user accounts due to reused usernames.
How do I fix CVE-2021-32726?
To fix CVE-2021-32726, upgrade Nextcloud Server to version 19.0.13, 20.0.11, or 21.0.3 or later.
What versions of Nextcloud Server are affected by CVE-2021-32726?
CVE-2021-32726 affects Nextcloud Server versions prior to 19.0.13, 20.0.11, and 21.0.3.
Can I be exploited through CVE-2021-32726 if I am a Nextcloud user?
Yes, if you reused a username from a deleted account, a former user could potentially gain access to your account.
What are the implications of CVE-2021-32726 for Nextcloud administrators?
Nextcloud administrators should ensure that user accounts are securely managed and promptly updated to mitigate risks associated with CVE-2021-32726.