What’s Vulnerable › Vulnerabilities

CVE-2023-32318: User session not correctly destroyed on logout

• Severity: medium (CVSS 6.7 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-05-26 · updated 2026-06-17
• Weakness: CWE-613

Description

Nextcloud server provides a home for data. A regression in the session handling between Nextcloud Server and the Nextcloud Text app prevented a correct destruction of the session on logout if cookies were not cleared manually. After successfully authenticating with any other account the previous session would be continued and the attacker would be authenticated as the previously logged in user. It is recommended that the Nextcloud Server is upgraded to 25.0.6 or 26.0.1.

Affected products

• Nextcloud Server: from 25.0.2 before 25.0.6; 26.0.0 — fixed in 25.0.6

How to fix

Upgrade to a fixed version: Nextcloud Server 25.0.6. Check the vendor advisory for mitigations.

References

• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-q8c4-chpj-6v38
• https://github.com/nextcloud/text/pull/3946
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-q8c4-chpj-6v38
• https://github.com/nextcloud/text/pull/3946

Get alerted when CVE-2023-32318 or the next vulnerability affects your stack