CVE-2018-3761

8.1 highEPSS 1.7%

Nextcloud Server before 12.0.8 and 13.0.3 suffer from improper authentication on the OAuth2 token endpoint. Missing checks potentially allowed handing out new tokens in case the OAuth2 client was partly compromised.

Severity

CVSS 3.1

8.1 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

EPSS: 1.7% chance of exploitation in the next 30 days; higher than 76% of CVEs (scores of 2026-10-31)
CWE: CWE-287
Published: 2018-07-05
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

nextcloud:nextcloud_server

References

https://hackerone.com/reports/343111
https://nextcloud.com/security/advisory/?id=nc-sa-2018-003
https://hackerone.com/reports/343111
https://nextcloud.com/security/advisory/?id=nc-sa-2018-003

Check your stack JSON