user_oidc app is an OpenID Connect user backend for Nextcloud. Missing access control on the ID4me endpoint allows an attacker to register an account eventually getting access to data that is available to all registered users. It is recommended that the OpenID Connect user backend is upgraded to 3.0.0 (Nextcloud 20-23), 4.0.0 (Nexcloud 24) or 5.0.0 (Nextcloud 25-28).
References
| Link | Resource |
|---|---|
| https://github.com/nextcloud/security-advisories/security/advisories/GHSA-vw7g-959g-vj6q | Vendor Advisory |
| https://github.com/nextcloud/security-advisories/security/advisories/GHSA-vw7g-959g-vj6q | Vendor Advisory |
| https://github.com/nextcloud/user_oidc/commit/9f68a716ecd264160a7c098b8840313f1ac855f2 | Patch |
| https://github.com/nextcloud/user_oidc/commit/9f68a716ecd264160a7c098b8840313f1ac855f2 | Patch |
| https://hackerone.com/reports/2376929 | Exploit Third Party Advisory |
| https://hackerone.com/reports/2376929 | Exploit Third Party Advisory |
Configurations
History
14 Aug 2025, 19:18
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | NVD-CWE-noinfo | |
| References | () https://github.com/nextcloud/security-advisories/security/advisories/GHSA-vw7g-959g-vj6q - Vendor Advisory | |
| References | () https://github.com/nextcloud/user_oidc/commit/9f68a716ecd264160a7c098b8840313f1ac855f2 - Patch | |
| References | () https://hackerone.com/reports/2376929 - Exploit, Third Party Advisory | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.3 |
| CPE | cpe:2.3:a:nextcloud:user_oidc:*:*:*:*:*:*:*:* | |
| First Time |
Nextcloud user Oidc
Nextcloud |
14 Jun 2024, 15:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-06-14 15:15
Updated : 2025-08-14 19:18
NVD link : CVE-2024-37312
Mitre link : CVE-2024-37312
JSON object : View
Products Affected
nextcloud
- user_oidc
CWE