Nextcloud versions 1.3.6 through 8.3.x contained an improper condition in the User OIDC LdapService, allowing LDAP users that had been deleted to still authenticate via the OIDC application. This flaw effectively bypasses the intended access control check and permits credentials that should no longer be valid to be accepted. The resulting impact is that an attacker could gain access to a deleted user’s account, potentially retrieving stored documents, messages, or other sensitive data, and may create a foothold for further lateral movement within the Nextcloud instance.

The vulnerability affects the Nextcloud open‑source content collaboration platform for any deployment using the User OIDC app with LDAP integration. All releases from version 1.3.6 up to, but not including, version 8.4.0 are susceptible. Users on 8.4.0 or later are not impacted because the patch was applied in that release.

With a CVSS score of 4.6 the vulnerability is classified as moderate. The exploit is relatively low cost because it requires only the ability to present valid credentials for a user that has been deleted from LDAP, and the attack vector is via the publicly reachable OIDC endpoints, meaning a remote attacker with knowledge of the credentials could execute it. EPSS data is not available, and the vulnerability is not listed in CISA’s KEV catalog, so there is no evidence of widespread exploitation yet. Nonetheless, the possibility of unauthorized access warrants prompt remediation.