Is CVE-2026-45284 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-45284 being exploited in the wild.

How severe is CVE-2026-45284?

Medium severity, with a CVSS score of 4.6, published 1 June 2026.

Which products and versions are affected?

Nextcloud User OIDC >= 1.3.6, < 8.4.0.

Is there a fix for CVE-2026-45284?

A patch was published on 2026-02-19: Fix merged into main branch via pull request 1340 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-45284 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-45284?

Check whether you run Nextcloud User OIDC at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-45284: Nextcloud User OIDC improper access control for deleted LDAP users

Q: Is there a fix for CVE-2026-45284?

A patch was published on 2026-02-19: Fix merged into main branch via pull request 1340 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-45284 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-45284?

Check whether you run Nextcloud User OIDC at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-45284 · Severity: medium · CVSS 4.6 · Published 2026-06-01

Nextcloud is an open-source content collaboration platform used for file sharing and communication. A security flaw in the platform's identity management system allowed users who were deleted from a central corporate directory (LDAP) to continue accessing the system via OpenID Connect (OIDC). This could allow former employees or unauthorized individuals to maintain access to sensitive corporate data and collaboration tools after their accounts should have been deactivated.

Technologies: Nextcloud User OIDC. Vendors: Nextcloud.

Quick answers

Is CVE-2026-45284 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-45284 being exploited in the wild.
How severe is CVE-2026-45284?: Medium severity, with a CVSS score of 4.6, published 1 June 2026.
Which products and versions are affected?: Nextcloud User OIDC >= 1.3.6, < 8.4.0.
Is there a fix for CVE-2026-45284?: A patch was published on 2026-02-19: Fix merged into main branch via pull request 1340 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-45284 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-45284?: Check whether you run Nextcloud User OIDC at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An improper access control vulnerability exists in the Nextcloud User OIDC app's LdapService. The root cause is a logic error in the `isLdapDeletedUser` check, which failed to correctly verify the status of users synchronized via LDAP when they attempted to authenticate using OpenID Connect (OIDC). Consequently, users deleted from the LDAP directory could still successfully authenticate and maintain access to the Nextcloud instance. Exploitation requires the attacker to have a pre-existing account that was deleted from LDAP but remains valid in the OIDC provider's context. The issue is resolved in version 8.4.0 by ensuring the service correctly identifies deleted LDAP users.

Affected products

Nextcloud User OIDC app for Nextcloud >= 1.3.6, < 8.4.0

Timeline

2026-02-19: patched: Fix merged into main branch via pull request 1340
2026-05-12: advisory: GitHub Security Advisory GHSA-79xf-ffj8-96fm published
2026-06-01: disclosed: CVE-2026-45284 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.