Medium severity · published Jun 14, 2024
CVE-2024-37312
Nextcloud user_oidc app's ID4me feature is available even when disabled
6.3
CVSS
0.6%
EPSS
No
On KEV
Description
user_oidc app is an OpenID Connect user backend for Nextcloud. Missing access control on the ID4me endpoint allows an attacker to register an account eventually getting access to data that is available to all registered users. It is recommended that the OpenID Connect user backend is upgraded to 3.0.0 (Nextcloud 20-23), 4.0.0 (Nexcloud 24) or 5.0.0 (Nextcloud 25-28).
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Attack vector
Adjacent
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 50% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SE
security-advisories · nextcloud
<= 1.3.6 · source: vendor
UO
User Oidc · Nextcloud
before 5.0.0 · source: NVD, CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-37312
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-37312
Vendor Advisory
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-vw7g-959g-vj6q
Patch
https://github.com/nextcloud/user_oidc/commit/9f68a716ecd264160a7c098b8840313f1ac855f2
Exploit
https://hackerone.com/reports/2376929
More from security-advisories
9.8
CVE-2022-31132
Unauthenticated SSRF in 3rd party module "cerdic/csstidy"
8.8
CVE-2026-45284
Nextcloud: Wrong condition in the User OIDC app's LdapService allowed deleted LDAP users to authenticate
8.2
CVE-2026-45545
Nextcloud: SQL Injection in Column Type Parameter Allows Arbitrary SQL Execution
8.2
CVE-2024-52519
Nextcloud Server's OAuth2 client secrets were stored in a recoverable way
8.1
CVE-2026-45281
Nextcloud: Cross-Account Calendar Takeover via Unauthorized Group-Member-Set Update