CVE-2023-32318

Name of the Vulnerable Software and Affected Versions Nextcloud Server versions prior to 25.0.6 Nextcloud Server versions prior to 26.0.1

Description A regression in the session handling between Nextcloud Server and the Nextcloud Text app prevented a correct destruction of the session on logout if cookies were not cleared manually. After successfully authenticating with any other account, the previous session would be continued and the attacker would be authenticated as the previously logged in user. This issue is related to incorrect session expiration.

Recommendations For Nextcloud Server versions prior to 25.0.6, upgrade to 25.0.6 to resolve the issue. For Nextcloud Server versions prior to 26.0.1, upgrade to 26.0.1 to resolve the issue. As a temporary workaround, consider clearing cookies manually after logout to prevent session continuation.