CVE-2023-32318

6.7 mediumEPSS 0.2%

Medium (6.7) in nextcloud nextcloud server. EPSS 0.2% chance of exploitation in the next 30 days.

Nextcloud server provides a home for data. A regression in the session handling between Nextcloud Server and the Nextcloud Text app prevented a correct destruction of the session on logout if cookies were not cleared manually. After successfully authenticating with any other account the previous session would be continued and the attacker would be authenticated as the previously logged in user. It is recommended that the Nextcloud Server is upgraded to 25.0.6 or 26.0.1.

Severity

CVSS 3.1

6.7 medium

CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

EPSS: 0.2% chance of exploitation in the next 30 days; higher than 11% of CVEs (scores of 2026-10-31)
CWE: CWE-613
Published: 2023-05-26
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

nextcloud:nextcloud_server

References

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-q8c4-chpj-6v38
https://github.com/nextcloud/text/pull/3946
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-q8c4-chpj-6v38
https://github.com/nextcloud/text/pull/3946

Check your stack JSON