CVE-2021-32726
📋 TL;DR
This vulnerability in Nextcloud Server allows account takeover when usernames are reused. When a user account is deleted, their WebAuthn authentication tokens remain active. If a new user later registers with the same username, the previous user could use their old tokens to access the new account. This affects all Nextcloud Server instances running vulnerable versions.
💻 Affected Systems
- Nextcloud Server
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Previous user gains full access to new user's account, potentially accessing sensitive files, contacts, calendar data, and performing actions as the legitimate user.
Likely Case
Account takeover leading to unauthorized access to personal or organizational data stored in Nextcloud.
If Mitigated
No impact if proper username management prevents reuse or if patched versions are used.
🎯 Exploit Status
Exploitation requires knowledge of deleted username and possession of old WebAuthn tokens. No public exploit code available but attack methodology is straightforward.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 19.0.13, 20.0.11, or 21.0.3 depending on your version branch
Vendor Advisory: https://github.com/nextcloud/security-advisories/security/advisories/GHSA-6qr9-c846-j8mg
Restart Required: Yes
Instructions:
1. Backup your Nextcloud installation and database. 2. Update to the patched version using your package manager or manual download. 3. Run occ upgrade command: sudo -u www-data php occ upgrade. 4. Restart web server (Apache/Nginx) and PHP-FPM if applicable.
🔧 Temporary Workarounds
Disable WebAuthn
allTemporarily disable WebAuthn authentication until patching is complete
sudo -u www-data php occ config:app:set twofactor_webauthn enabled --value false
🧯 If You Can't Patch
- Implement strict username management policy preventing reuse of deleted usernames
- Monitor authentication logs for suspicious WebAuthn token usage patterns
🔍 How to Verify
Check if Vulnerable:
Check Nextcloud version via occ command: sudo -u www-data php occ status | grep versionCheck Version:
sudo -u www-data php occ status | grep versionVerify Fix Applied:
Verify version is 19.0.13+, 20.0.11+, or 21.0.3+ and test that deleted user WebAuthn tokens are properly removed📡 Detection & Monitoring
Log Indicators:
- Failed WebAuthn authentication attempts from deleted users
- Successful authentication with WebAuthn tokens for recently created accounts
Network Indicators:
- Unusual authentication patterns from previously deleted user accounts
SIEM Query:
source="nextcloud.log" AND ("webauthn" AND "authentication" AND ("failed" OR "success")) AND user="*deleted_user*"🔗 References
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-6qr9-c846-j8mg
- https://github.com/nextcloud/server/pull/27532
- https://hackerone.com/reports/1202590
- https://security.gentoo.org/glsa/202208-17
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-6qr9-c846-j8mg
- https://github.com/nextcloud/server/pull/27532
- https://hackerone.com/reports/1202590
- https://security.gentoo.org/glsa/202208-17
