Search
Find a vulnerability
Search criteria
314 vulnerabilities by NextCloud
CVE-2026-82984 (GCVE-0-2026-82984)
Vulnerability from cvelistv5 – Published: 2026-10-27 16:15 – Updated: 2026-11-04 20:25
VLAI
EPSS
VEX
Summary
When a team was configured as "visible to everyone", the web UI correctly blocked non-members from viewing the team ("You are not a member of ..."), but the resources API endpoint could still be called directly, allowing any authenticated non-member to enumerate the team's internal resources and their identifiers.
This does not grant access to the contents of the discovered resources themselves, only their existence, names, and identifiers.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-04 19:32 UTC
CWE
- CWE-284 - Improper Access Control - Generic
Assigner
hackerone
CNA
References
1 reference
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82984",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-04T19:32:09.273078Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T20:25:03.302Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Server",
"vendor": "Nextcloud",
"versions": [
{
"lessThanOrEqual": "33.0.0",
"status": "affected",
"version": "32.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "_dha (yoyomiski)"
}
],
"descriptions": [
{
"lang": "en",
"value": "When a team was configured as \"visible to everyone\", the web UI correctly blocked non-members from viewing the team (\"You are not a member of ...\"), but the resources API endpoint could still be called directly, allowing any authenticated non-member to enumerate the team\u0027s internal resources and their identifiers.\n\nThis does not grant access to the contents of the discovered resources themselves, only their existence, names, and identifiers."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284 Improper Access Control - Generic",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T16:15:34.831Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://hackerone.com/reports/3511955"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2026-82984",
"datePublished": "2026-10-27T16:15:34.831Z",
"dateReserved": "2026-08-31T15:00:00.544Z",
"dateUpdated": "2026-11-04T20:25:03.302Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-77167 (GCVE-0-2026-77167)
Vulnerability from cvelistv5 – Published: 2026-10-27 16:15 – Updated: 2026-11-04 20:25
VLAI
EPSS
VEX
Summary
Abusing the federated share endpoint, an attacker can write arbitrary rows into the oc_share_external database table. These rows persist indefinitely — there is no automatic cleanup mechanism. Three distinct denial-of-service conditions follow from this write primitive, all triggered from the same unauthenticated source and all self-renewing on a 24-hour cycle for as long as the injected rows remain in the database.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-04 20:07 UTC
CWE
- CWE-400 - Uncontrolled Resource Consumption
Assigner
hackerone
CNA
References
1 reference
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-77167",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-04T20:07:41.893986Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T20:25:10.944Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "server",
"vendor": "Nextcloud",
"versions": [
{
"lessThanOrEqual": "34.0.0",
"status": "affected",
"version": "22.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "ncsc_nl"
}
],
"descriptions": [
{
"lang": "en",
"value": "Abusing the federated share endpoint, an attacker can write arbitrary rows into the oc_share_external database table. These rows persist indefinitely \u2014 there is no automatic cleanup mechanism. Three distinct denial-of-service conditions follow from this write primitive, all triggered from the same unauthenticated source and all self-renewing on a 24-hour cycle for as long as the injected rows remain in the database."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400 Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T16:15:34.778Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://hackerone.com/reports/3679640"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2026-77167",
"datePublished": "2026-10-27T16:15:34.778Z",
"dateReserved": "2026-08-20T15:00:00.606Z",
"dateUpdated": "2026-11-04T20:25:10.944Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-77173 (GCVE-0-2026-77173)
Vulnerability from cvelistv5 – Published: 2026-10-27 16:15 – Updated: 2026-11-04 20:25
VLAI
EPSS
VEX
Summary
A user could create a docx or odt file with a # in the filename with confidential information such as a credit card number and have it not be marked as confidential.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-04 19:32 UTC
CWE
- CWE-284 - Improper Access Control - Generic
Assigner
hackerone
CNA
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Nextcloud | Files Confidential |
Affected:
3.3.0 , ≤ 5.0.0
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-77173",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-04T19:32:07.896827Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T20:25:17.386Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Files Confidential",
"vendor": "Nextcloud",
"versions": [
{
"lessThanOrEqual": "5.0.0",
"status": "affected",
"version": "3.3.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "XavLimSG (xavlimsg)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A user could create a docx or odt file with a # in the filename with confidential information such as a credit card number and have it not be marked as confidential."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284 Improper Access Control - Generic",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T16:15:34.777Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://hackerone.com/reports/3682163"
}
],
"workarounds": [
{
"lang": "en",
"value": "Change config setting: Add # to forbidden_filename_characters and rename all affected files"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2026-77173",
"datePublished": "2026-10-27T16:15:34.777Z",
"dateReserved": "2026-08-20T15:00:00.607Z",
"dateUpdated": "2026-11-04T20:25:17.386Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-67400 (GCVE-0-2026-67400)
Vulnerability from cvelistv5 – Published: 2026-10-27 16:15 – Updated: 2026-11-04 20:25
VLAI
EPSS
VEX
Summary
A missing token type check allowed to retrieve more additional information about the WOPI configuration with a user or guest token.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-04 19:32 UTC
CWE
- CWE-284 - Improper Access Control - Generic
Assigner
hackerone
CNA
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Nextcloud | Richdocuments |
Affected:
11.0.0 , ≤ 11.0.0
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-67400",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-04T19:32:06.273605Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T20:25:23.074Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Richdocuments",
"vendor": "Nextcloud",
"versions": [
{
"lessThanOrEqual": "11.0.0",
"status": "affected",
"version": "11.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ibrahim el zein (bornwinnerrr)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A missing token type check allowed to retrieve more additional information about the WOPI configuration with a user or guest token."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 3.5,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284 Improper Access Control - Generic",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T16:15:34.773Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://hackerone.com/reports/3568116"
}
],
"workarounds": [
{
"lang": "en",
"value": "Disable app richdocuments"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2026-67400",
"datePublished": "2026-10-27T16:15:34.773Z",
"dateReserved": "2026-07-29T15:00:02.294Z",
"dateUpdated": "2026-11-04T20:25:23.074Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-77171 (GCVE-0-2026-77171)
Vulnerability from cvelistv5 – Published: 2026-10-27 16:15 – Updated: 2026-11-04 20:25
VLAI
EPSS
VEX
Summary
A public shared collective always allowed recipients of the link to create pages.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-04 19:32 UTC
CWE
- CWE-284 - Improper Access Control - Generic
Assigner
hackerone
CNA
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Nextcloud | Collectives |
Affected:
4.0.0 , ≤ 4.0.0
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-77171",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-04T19:32:04.896377Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T20:25:28.802Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Collectives",
"vendor": "Nextcloud",
"versions": [
{
"lessThanOrEqual": "4.0.0",
"status": "affected",
"version": "4.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "_dha (yoyomiski)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A public shared collective always allowed recipients of the link to create pages."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 3.5,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284 Improper Access Control - Generic",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T16:15:34.770Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://hackerone.com/reports/3533697"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2026-77171",
"datePublished": "2026-10-27T16:15:34.770Z",
"dateReserved": "2026-08-20T15:00:00.606Z",
"dateUpdated": "2026-11-04T20:25:28.802Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-77172 (GCVE-0-2026-77172)
Vulnerability from cvelistv5 – Published: 2026-10-27 16:15 – Updated: 2026-11-04 17:58
VLAI
EPSS
VEX
Summary
App passwords were allowed to bypass password confirmation on sensitive endpoints.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-04 17:58 UTC
CWE
- CWE-269 - Improper Privilege Management
Assigner
hackerone
CNA
References
1 reference
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-77172",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-04T17:58:16.970924Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T17:58:26.808Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Server",
"vendor": "Nextcloud",
"versions": [
{
"lessThanOrEqual": "34.0.0",
"status": "affected",
"version": "32.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Nicholas Carlini (npc)"
}
],
"descriptions": [
{
"lang": "en",
"value": "App passwords were allowed to bypass password confirmation on sensitive endpoints."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "CWE-269 Improper Privilege Management",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T16:15:34.765Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://hackerone.com/reports/3566607"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2026-77172",
"datePublished": "2026-10-27T16:15:34.765Z",
"dateReserved": "2026-08-20T15:00:00.607Z",
"dateUpdated": "2026-11-04T17:58:26.808Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-87897 (GCVE-0-2026-87897)
Vulnerability from cvelistv5 – Published: 2026-10-27 16:15 – Updated: 2026-11-04 17:59
VLAI
EPSS
VEX
Summary
A SSRF vulnerability found that enables access to internal Chrome Devtools Protocol APIs that can leak the JWT authentication token for another user. A low privileged attacker could continually exploit this vulnerability to leak the JWT authentication token for another user when they start a recording, which then enables the attacker read/write access to the victim's Whiteboard.
Severity
4.6 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-04 17:58 UTC
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
hackerone
CNA
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Nextcloud | whiteboard |
Affected:
1.0.0 , < 1.0.0
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-87897",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-04T17:58:52.045220Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T17:59:02.350Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "whiteboard",
"vendor": "Nextcloud",
"versions": [
{
"lessThan": "1.0.0",
"status": "affected",
"version": "1.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "alex-elttam (alex-elttam)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A SSRF vulnerability found that enables access to internal Chrome Devtools Protocol APIs that can leak the JWT authentication token for another user. A low privileged attacker could continually exploit this vulnerability to leak the JWT authentication token for another user when they start a recording, which then enables the attacker read/write access to the victim\u0027s Whiteboard."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 4.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918 Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T16:15:34.742Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://hackerone.com/reports/3576823"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2026-87897",
"datePublished": "2026-10-27T16:15:34.742Z",
"dateReserved": "2026-09-09T15:00:00.573Z",
"dateUpdated": "2026-11-04T17:59:02.350Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82983 (GCVE-0-2026-82983)
Vulnerability from cvelistv5 – Published: 2026-10-27 16:15 – Updated: 2026-11-04 17:53
VLAI
EPSS
VEX
Summary
The Tables app's share-listing endpoint (GET /apps/tables/share/table/{tableId}) did not verify that the requesting user has manage-level permission on the table before returning the full list of share recipients (users, groups, and teams) along with their permission levels. A user who was only granted read-data access to a table, and who is correctly prevented from seeing this information in the web UI, could call the endpoint directly to enumerate everyone the table is shared with and their access levels.
This does not expose the table's data itself beyond what the read-data grant already permits, only the list of share recipients and their permission levels.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-04 17:52 UTC
CWE
- CWE-200 - Information Disclosure
Assigner
hackerone
CNA
References
1 reference
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82983",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-04T17:52:46.125191Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T17:53:04.349Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Tables",
"vendor": "Nextcloud",
"versions": [
{
"lessThanOrEqual": "2.0.0",
"status": "affected",
"version": "0.8.1",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "_dha (yoyomiski)"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Tables app\u0027s share-listing endpoint (GET /apps/tables/share/table/{tableId}) did not verify that the requesting user has manage-level permission on the table before returning the full list of share recipients (users, groups, and teams) along with their permission levels. A user who was only granted read-data access to a table, and who is correctly prevented from seeing this information in the web UI, could call the endpoint directly to enumerate everyone the table is shared with and their access levels.\n\nThis does not expose the table\u0027s data itself beyond what the read-data grant already permits, only the list of share recipients and their permission levels."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 3.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200 Information Disclosure",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T16:15:34.683Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://hackerone.com/reports/3524971"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2026-82983",
"datePublished": "2026-10-27T16:15:34.683Z",
"dateReserved": "2026-08-31T15:00:00.543Z",
"dateUpdated": "2026-11-04T17:53:04.349Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82986 (GCVE-0-2026-82986)
Vulnerability from cvelistv5 – Published: 2026-10-27 16:15 – Updated: 2026-11-04 17:47
VLAI
EPSS
VEX
Summary
The user in a group can bypass the group restriction set by an administrator on link sharing, creating share links for a table even though they shouldn't have that permission.
Severity
4.6 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-04 17:47 UTC
CWE
- CWE-284 - Improper Access Control - Generic
Assigner
hackerone
CNA
References
1 reference
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82986",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-04T17:47:39.070313Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T17:47:48.887Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Tables",
"vendor": "Nextcloud",
"versions": [
{
"lessThanOrEqual": "1.0.0",
"status": "affected",
"version": "0.6.4",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The user in a group can bypass the group restriction set by an administrator on link sharing, creating share links for a table even though they shouldn\u0027t have that permission."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 4.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284 Improper Access Control - Generic",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T16:15:34.671Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://hackerone.com/reports/3642236"
}
],
"workarounds": [
{
"lang": "en",
"value": "The user in a group can bypass the group restriction set by an administrator on link sharing, creating share links for a table even though they shouldn\u0027t have that permission."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2026-82986",
"datePublished": "2026-10-27T16:15:34.671Z",
"dateReserved": "2026-08-31T15:00:00.544Z",
"dateUpdated": "2026-11-04T17:47:48.887Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-77165 (GCVE-0-2026-77165)
Vulnerability from cvelistv5 – Published: 2026-09-21 15:25 – Updated: 2026-09-21 18:44
VLAI
EPSS
VEX
Summary
File owners were unable to unlock TYPE_TOKEN locks placed by other users, leaving files permanently locked with no recovery path outside of the database.
Severity
6.5 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-21 18:44 UTC
CWE
- CWE-284 - Improper Access Control - Generic
Assigner
hackerone
CNA
References
1 reference
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-77165",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-21T18:44:04.025208Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T18:44:22.324Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://hackerone.com/reports/3770482"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Server",
"vendor": "Nextcloud",
"versions": [
{
"lessThanOrEqual": "34.0.0",
"status": "affected",
"version": "32.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "rz1027 (rz1027)"
}
],
"descriptions": [
{
"lang": "en",
"value": "File owners were unable to unlock TYPE_TOKEN locks placed by other users, leaving files permanently locked with no recovery path outside of the database."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284 Improper Access Control - Generic",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T15:25:33.553Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://hackerone.com/reports/3770482"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2026-77165",
"datePublished": "2026-09-21T15:25:33.553Z",
"dateReserved": "2026-08-20T15:00:00.606Z",
"dateUpdated": "2026-09-21T18:44:22.324Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-77166 (GCVE-0-2026-77166)
Vulnerability from cvelistv5 – Published: 2026-09-21 15:25 – Updated: 2026-09-21 18:43
VLAI
EPSS
VEX
Summary
The emoji field in the page emoji update endpoint does not properly validate user input. By injecting long text and line breaks, the sidebar layout becomes broken and can hide other items.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-21 18:42 UTC
CWE
- CWE-840 - Business Logic Errors
Assigner
hackerone
CNA
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Nextcloud | Collectives |
Affected:
3.2.1 , ≤ 3.5.0
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-77166",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-21T18:42:53.420732Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T18:43:30.904Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://hackerone.com/reports/3599470"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Collectives",
"vendor": "Nextcloud",
"versions": [
{
"lessThanOrEqual": "3.5.0",
"status": "affected",
"version": "3.2.1",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "_dha (yoyomiski)"
}
],
"descriptions": [
{
"lang": "en",
"value": "The emoji field in the page emoji update endpoint does not properly validate user input. By injecting long text and line breaks, the sidebar layout becomes broken and can hide other items."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 2.4,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-840",
"description": "CWE-840 Business Logic Errors",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T15:25:33.269Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://hackerone.com/reports/3599470"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2026-77166",
"datePublished": "2026-09-21T15:25:33.269Z",
"dateReserved": "2026-08-20T15:00:00.606Z",
"dateUpdated": "2026-09-21T18:43:30.904Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68493 (GCVE-0-2026-68493)
Vulnerability from cvelistv5 – Published: 2026-09-18 01:26 – Updated: 2026-09-18 19:40
VLAI
EPSS
VEX
Summary
After guessing a 62^15 complex unique identifier, a malicious logged in user was able to retrieve a list of memberships for a circle they are not a member of.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-18 19:40 UTC
CWE
- CWE-639 - Insecure Direct Object Reference (IDOR)
Assigner
hackerone
CNA
References
1 reference
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-68493",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-18T19:40:01.086889Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T19:40:16.781Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Server",
"vendor": "Nextcloud",
"versions": [
{
"lessThanOrEqual": "34.0.0",
"status": "affected",
"version": "32.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Melanie (milou)"
}
],
"descriptions": [
{
"lang": "en",
"value": "After guessing a 62^15 complex unique identifier, a malicious logged in user was able to retrieve a list of memberships for a circle they are not a member of."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 3.1,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639 Insecure Direct Object Reference (IDOR)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T01:26:04.654Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://hackerone.com/reports/3484601"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2026-68493",
"datePublished": "2026-09-18T01:26:04.654Z",
"dateReserved": "2026-07-30T15:00:00.609Z",
"dateUpdated": "2026-09-18T19:40:16.781Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82985 (GCVE-0-2026-82985)
Vulnerability from cvelistv5 – Published: 2026-09-18 01:26 – Updated: 2026-09-18 19:40
VLAI
EPSS
VEX
Summary
The Photos app's filter-based "smart albums" build their file listing using the search configuration (photosSourceFolders) of the user viewing the album, rather than the album owner's configuration. When an album owner shares a smart album with another user, that user's own folder configuration is used to determine which of the owner's files are searched — allowing them to discover files (name, file ID, and other metadata) in folders the album owner never intended to include in the shared album.
This requires the album owner to have shared a filter-based smart album with the attacker; it does not allow access to arbitrary users' files without such a share.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-18 19:40 UTC
CWE
- CWE-284 - Improper Access Control - Generic
Assigner
hackerone
CNA
References
1 reference
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82985",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-18T19:40:32.206813Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T19:40:43.484Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Server",
"vendor": "Nextcloud",
"versions": [
{
"lessThan": "32.0.0",
"status": "affected",
"version": "32.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Joseph Semaan (suul)"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Photos app\u0027s filter-based \"smart albums\" build their file listing using the search configuration (photosSourceFolders) of the user viewing the album, rather than the album owner\u0027s configuration. When an album owner shares a smart album with another user, that user\u0027s own folder configuration is used to determine which of the owner\u0027s files are searched \u2014 allowing them to discover files (name, file ID, and other metadata) in folders the album owner never intended to include in the shared album.\n\nThis requires the album owner to have shared a filter-based smart album with the attacker; it does not allow access to arbitrary users\u0027 files without such a share."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284 Improper Access Control - Generic",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T01:26:04.650Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://hackerone.com/reports/3506873"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2026-82985",
"datePublished": "2026-09-18T01:26:04.650Z",
"dateReserved": "2026-08-31T15:00:00.544Z",
"dateUpdated": "2026-09-18T19:40:43.484Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-77164 (GCVE-0-2026-77164)
Vulnerability from cvelistv5 – Published: 2026-09-18 01:26 – Updated: 2026-09-18 19:41
VLAI
EPSS
VEX
Summary
Circles' remote-instance signature verification fetches the attacker-supplied keyId URL before trust in the remote instance is established, and explicitly allows local/private addresses for this request, bypassing Nextcloud's core SSRF protections. The public, unauthenticated endpoints POST /apps/circles/event/ and POST /apps/circles/incoming/ reach this code path, allowing any unauthenticated user to force the server to issue a GET request to an internal address.
The response body of the internal request is never returned to the requester, so this is blind SSRF: an attacker can determine whether an internal service is reachable, but cannot read its response contents through this endpoint alone.
Severity
6.2 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-18 19:40 UTC
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
hackerone
CNA
References
1 reference
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-77164",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-18T19:40:57.953385Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T19:41:07.400Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Server",
"vendor": "Nextcloud",
"versions": [
{
"lessThanOrEqual": "32.0.0",
"status": "affected",
"version": "31.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Balvant Chavda (0x0doteth)"
}
],
"descriptions": [
{
"lang": "en",
"value": "Circles\u0027 remote-instance signature verification fetches the attacker-supplied keyId URL before trust in the remote instance is established, and explicitly allows local/private addresses for this request, bypassing Nextcloud\u0027s core SSRF protections. The public, unauthenticated endpoints POST /apps/circles/event/ and POST /apps/circles/incoming/ reach this code path, allowing any unauthenticated user to force the server to issue a GET request to an internal address.\n\nThe response body of the internal request is never returned to the requester, so this is blind SSRF: an attacker can determine whether an internal service is reachable, but cannot read its response contents through this endpoint alone."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 6.2,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918 Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T01:26:04.650Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://hackerone.com/reports/3303283"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2026-77164",
"datePublished": "2026-09-18T01:26:04.650Z",
"dateReserved": "2026-08-20T15:00:00.606Z",
"dateUpdated": "2026-09-18T19:41:07.400Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-77170 (GCVE-0-2026-77170)
Vulnerability from cvelistv5 – Published: 2026-09-18 01:26 – Updated: 2026-09-18 19:41
VLAI
EPSS
VEX
Summary
The Deck config API allows authenticated users to set board-scoped configuration keys for arbitrary board IDs without validating whether the user owns or has permission to manage the referenced board.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-18 19:41 UTC
CWE
- CWE-284 - Improper Access Control - Generic
Assigner
hackerone
CNA
References
1 reference
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-77170",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-18T19:41:21.226672Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T19:41:31.474Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Deck",
"vendor": "Nextcloud",
"versions": [
{
"lessThanOrEqual": "1.18.0",
"status": "affected",
"version": "1.16.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Dang Hung Vi (vidang04)"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Deck config API allows authenticated users to set board-scoped configuration keys for arbitrary board IDs without validating whether the user owns or has permission to manage the referenced board."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284 Improper Access Control - Generic",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T01:26:04.640Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://hackerone.com/reports/3599383"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2026-77170",
"datePublished": "2026-09-18T01:26:04.640Z",
"dateReserved": "2026-08-20T15:00:00.606Z",
"dateUpdated": "2026-09-18T19:41:31.474Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82982 (GCVE-0-2026-82982)
Vulnerability from cvelistv5 – Published: 2026-09-18 01:26 – Updated: 2026-09-18 19:42
VLAI
EPSS
VEX
Summary
The Approval app's approve/reject endpoint is meant to require the file's current etag as a freshness check, preventing an approver from approving or rejecting a file whose contents changed after they reviewed it. The backend only enforced this check when the etag parameter was present and non-empty in the request. An attacker able to intercept and modify the approval request could omit the etag field entirely, bypassing the freshness check and approving or rejecting a file version they never reviewed.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-18 19:41 UTC
CWE
- CWE-840 - Business Logic Errors
Assigner
hackerone
CNA
References
1 reference
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82982",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-18T19:41:50.479115Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T19:42:03.054Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Approval",
"vendor": "Nextcloud",
"versions": [
{
"lessThanOrEqual": "3.0.0",
"status": "affected",
"version": "1.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Dang Hung Vi (vidang04)"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Approval app\u0027s approve/reject endpoint is meant to require the file\u0027s current etag as a freshness check, preventing an approver from approving or rejecting a file whose contents changed after they reviewed it. The backend only enforced this check when the etag parameter was present and non-empty in the request. An attacker able to intercept and modify the approval request could omit the etag field entirely, bypassing the freshness check and approving or rejecting a file version they never reviewed."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-840",
"description": "CWE-840 Business Logic Errors",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T01:26:04.619Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://hackerone.com/reports/3610332"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2026-82982",
"datePublished": "2026-09-18T01:26:04.619Z",
"dateReserved": "2026-08-31T15:00:00.543Z",
"dateUpdated": "2026-09-18T19:42:03.054Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-77169 (GCVE-0-2026-77169)
Vulnerability from cvelistv5 – Published: 2026-09-18 01:26 – Updated: 2026-09-18 19:42
VLAI
EPSS
VEX
Summary
A vulnerability in the team folders (formerly group folders) app when used in combination with the workspace app allowed API/REST-only delegated administrators to bypass folder-level authorization controls. The workspace app enables organizations to delegate limited administrative privileges for team folder management via API/REST only, restricting access to folders for which the admin has advanced permissions.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-18 19:42 UTC
CWE
- CWE-284 - Improper Access Control - Generic
Assigner
hackerone
CNA
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Nextcloud | Team Folders |
Affected:
13.0.0 , < 22.0.0
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-77169",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-18T19:42:21.795020Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T19:42:32.751Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Team Folders",
"vendor": "Nextcloud",
"versions": [
{
"lessThan": "22.0.0",
"status": "affected",
"version": "13.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "qloo (qloo)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in the team folders (formerly group folders) app when used in combination with the workspace app allowed API/REST-only delegated administrators to bypass folder-level authorization controls. The workspace app enables organizations to delegate limited administrative privileges for team folder management via API/REST only, restricting access to folders for which the admin has advanced permissions."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284 Improper Access Control - Generic",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T01:26:04.614Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://hackerone.com/reports/3674940"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2026-77169",
"datePublished": "2026-09-18T01:26:04.614Z",
"dateReserved": "2026-08-20T15:00:00.606Z",
"dateUpdated": "2026-09-18T19:42:32.751Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82980 (GCVE-0-2026-82980)
Vulnerability from cvelistv5 – Published: 2026-09-18 01:26 – Updated: 2026-09-18 19:42
VLAI
EPSS
VEX
Summary
Any authenticated user can lock or unlock files they do not own by targeting absolute WebDAV paths of other users. The DAV plugin resolves files from the absolute request URI without verifying that the path segment matches the authenticated session user. This enables:
Cross-user manual locks : attacker locks a victim's files, blocking writes (PUT/MOVE/DELETE, editor saves).
Lock-token disclosure: the app returns the lock token to unauthorized callers, enabling them to remove token-based locks (client locks) of other users.
Severity
6.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-18 19:42 UTC
CWE
- CWE-287 - Improper Authentication - Generic
Assigner
hackerone
CNA
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Nextcloud | Files Lock |
Affected:
31.0.0 , ≤ 33.0.0
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82980",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-18T19:42:46.238881Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T19:42:58.732Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Files Lock",
"vendor": "Nextcloud",
"versions": [
{
"lessThanOrEqual": "33.0.0",
"status": "affected",
"version": "31.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Balvant Chavda (0x0doteth)"
}
],
"descriptions": [
{
"lang": "en",
"value": "Any authenticated user can lock or unlock files they do not own by targeting absolute WebDAV paths of other users. The DAV plugin resolves files from the absolute request URI without verifying that the path segment matches the authenticated session user. This enables:\n\nCross-user manual locks : attacker locks a victim\u0027s files, blocking writes (PUT/MOVE/DELETE, editor saves).\nLock-token disclosure: the app returns the lock token to unauthorized callers, enabling them to remove token-based locks (client locks) of other users."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "CWE-287 Improper Authentication - Generic",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T01:26:04.588Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://hackerone.com/reports/3301553"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2026-82980",
"datePublished": "2026-09-18T01:26:04.588Z",
"dateReserved": "2026-08-31T15:00:00.543Z",
"dateUpdated": "2026-09-18T19:42:58.732Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45810 (GCVE-0-2026-45810)
Vulnerability from cvelistv5 – Published: 2026-06-01 17:13 – Updated: 2026-06-02 12:48
VLAI
EPSS
VEX
Title
Nextcloud: Propfind requests for file comments allowed to load comments for other files
Summary
Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 31.0.0 to before 31.0.12, and 32.0.0 to before 32.0.3, a missing check of a relation allowed authenticated users with access to any file comment, to read the content of all comments. It is recommended that the Nextcloud Server is upgraded to 31.0.12 or 32.0.3. It is recommended that the Nextcloud Enterprise Server is upgraded to 21.0.9.20, 22.2.10.35, 23.0.12.31, 24.0.12.30, 25.0.13.25, 26.0.13.22, 27.1.11.22, 28.0.14.13, 29.0.16.10, 30.0.17.5, 31.0.12 or 32.0.3
Severity
6.8 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-02 12:48 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
GitHub_M
CNA
References
3 references
| URL | Tags |
|---|---|
| https://github.com/nextcloud/security-advisories/… | x_refsource_CONFIRM |
| https://github.com/nextcloud/server/pull/56982 | x_refsource_MISC |
| https://hackerone.com/reports/3425534 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| nextcloud | security-advisories |
Affected:
>= 31.0.0, < 31.0.12
Affected: >= 32.0.0, < 32.0.3 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-45810",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-02T12:48:04.430888Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-02T12:48:15.018Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "security-advisories",
"vendor": "nextcloud",
"versions": [
{
"status": "affected",
"version": "\u003e= 31.0.0, \u003c 31.0.12"
},
{
"status": "affected",
"version": "\u003e= 32.0.0, \u003c 32.0.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 31.0.0 to before 31.0.12, and 32.0.0 to before 32.0.3, a missing check of a relation allowed authenticated users with access to any file comment, to read the content of all comments. It is recommended that the Nextcloud Server is upgraded to 31.0.12 or 32.0.3. It is recommended that the Nextcloud Enterprise Server is upgraded to 21.0.9.20, 22.2.10.35, 23.0.12.31, 24.0.12.30, 25.0.13.25, 26.0.13.22, 27.1.11.22, 28.0.14.13, 29.0.16.10, 30.0.17.5, 31.0.12 or 32.0.3"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-01T17:13:21.681Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-285v-p9x9-cjhj",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-285v-p9x9-cjhj"
},
{
"name": "https://github.com/nextcloud/server/pull/56982",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/nextcloud/server/pull/56982"
},
{
"name": "https://hackerone.com/reports/3425534",
"tags": [
"x_refsource_MISC"
],
"url": "https://hackerone.com/reports/3425534"
}
],
"source": {
"advisory": "GHSA-285v-p9x9-cjhj",
"discovery": "UNKNOWN"
},
"title": "Nextcloud: Propfind requests for file comments allowed to load comments for other files"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-45810",
"datePublished": "2026-06-01T17:13:21.681Z",
"dateReserved": "2026-05-13T08:19:32.605Z",
"dateUpdated": "2026-06-02T12:48:15.018Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45722 (GCVE-0-2026-45722)
Vulnerability from cvelistv5 – Published: 2026-06-01 17:11 – Updated: 2026-06-01 19:33
VLAI
EPSS
VEX
Title
Nextcloud: Tables app allows limited SQLi in ORDER BY with malicious sort order argument for Table Views
Summary
Nextcloud is an open source content collaboration platform. From versions 0.9.0 to before 0.9.7, and 1.0.0 to before 1.0.2, a missing sanitization in the Tables app allowed a user with access to the tables app to perform a limited SQL injection in the ORDER BY statement of a query. Compared to normal SQL injections, the ORDER BY is limited to extracting a single bit of information per request or to make the database wait for a given time. This issue has been patched in versions 0.9.7 and 1.0.2.
Severity
7.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-01 19:33 UTC
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Assigner
GitHub_M
CNA
References
3 references
| URL | Tags |
|---|---|
| https://github.com/nextcloud/security-advisories/… | x_refsource_CONFIRM |
| https://github.com/nextcloud/tables/pull/2186 | x_refsource_MISC |
| https://hackerone.com/reports/3446689 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| nextcloud | security-advisories |
Affected:
>= 0.9.0, < 0.9.7
Affected: >= 1.0.0, < 1.0.2 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-45722",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-01T19:33:35.307057Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-01T19:33:47.068Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "security-advisories",
"vendor": "nextcloud",
"versions": [
{
"status": "affected",
"version": "\u003e= 0.9.0, \u003c 0.9.7"
},
{
"status": "affected",
"version": "\u003e= 1.0.0, \u003c 1.0.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Nextcloud is an open source content collaboration platform. From versions 0.9.0 to before 0.9.7, and 1.0.0 to before 1.0.2, a missing sanitization in the Tables app allowed a user with access to the tables app to perform a limited SQL injection in the ORDER BY statement of a query. Compared to normal SQL injections, the ORDER BY is limited to extracting a single bit of information per request or to make the database wait for a given time. This issue has been patched in versions 0.9.7 and 1.0.2."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-01T17:11:15.481Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-5h2w-c7px-hp4j",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-5h2w-c7px-hp4j"
},
{
"name": "https://github.com/nextcloud/tables/pull/2186",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/nextcloud/tables/pull/2186"
},
{
"name": "https://hackerone.com/reports/3446689",
"tags": [
"x_refsource_MISC"
],
"url": "https://hackerone.com/reports/3446689"
}
],
"source": {
"advisory": "GHSA-5h2w-c7px-hp4j",
"discovery": "UNKNOWN"
},
"title": "Nextcloud: Tables app allows limited SQLi in ORDER BY with malicious sort order argument for Table Views"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-45722",
"datePublished": "2026-06-01T17:11:15.481Z",
"dateReserved": "2026-05-13T05:51:48.666Z",
"dateUpdated": "2026-06-01T19:33:47.068Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45691 (GCVE-0-2026-45691)
Vulnerability from cvelistv5 – Published: 2026-06-01 17:09 – Updated: 2026-06-01 19:10
VLAI
EPSS
VEX
Title
Nextcloud: Bypass of second factor authentication on DAV endpoints
Summary
Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, a pre-2FA session cookie (created after successful password authentication but before TOTP completion) could be reused as a Bearer token to authenticate against DAV endpoints, granting read/write access and bypassing mandatory two-factor authentication. It is recommended that the Nextcloud Server is upgraded to 33.0.3 or 32.0.9. It is recommended that the Nextcloud Enterprise Server is upgraded to 33.0.3, 32.0.9, 31.0.14.5, 30.0.17.9 or 29.0.16.16
Severity
5.9 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-01 19:09 UTC
CWE
- CWE-287 - Improper Authentication
Assigner
GitHub_M
CNA
References
3 references
| URL | Tags |
|---|---|
| https://github.com/nextcloud/security-advisories/… | x_refsource_CONFIRM |
| https://github.com/nextcloud/server/pull/59758 | x_refsource_MISC |
| https://hackerone.com/reports/3573399 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| nextcloud | security-advisories |
Affected:
>= 32.0.0, < 32.0.9
Affected: >= 33.0.0, < 33.0.3 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-45691",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-01T19:09:58.256884Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-01T19:10:18.647Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "security-advisories",
"vendor": "nextcloud",
"versions": [
{
"status": "affected",
"version": "\u003e= 32.0.0, \u003c 32.0.9"
},
{
"status": "affected",
"version": "\u003e= 33.0.0, \u003c 33.0.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, a pre-2FA session cookie (created after successful password authentication but before TOTP completion) could be reused as a Bearer token to authenticate against DAV endpoints, granting read/write access and bypassing mandatory two-factor authentication. It is recommended that the Nextcloud Server is upgraded to 33.0.3 or 32.0.9. It is recommended that the Nextcloud Enterprise Server is upgraded to 33.0.3, 32.0.9, 31.0.14.5, 30.0.17.9 or 29.0.16.16"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "CWE-287: Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-01T17:09:48.217Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-mp6x-g55j-w9jw",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-mp6x-g55j-w9jw"
},
{
"name": "https://github.com/nextcloud/server/pull/59758",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/nextcloud/server/pull/59758"
},
{
"name": "https://hackerone.com/reports/3573399",
"tags": [
"x_refsource_MISC"
],
"url": "https://hackerone.com/reports/3573399"
}
],
"source": {
"advisory": "GHSA-mp6x-g55j-w9jw",
"discovery": "UNKNOWN"
},
"title": "Nextcloud: Bypass of second factor authentication on DAV endpoints"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-45691",
"datePublished": "2026-06-01T17:09:48.217Z",
"dateReserved": "2026-05-13T04:38:01.164Z",
"dateUpdated": "2026-06-01T19:10:18.647Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45690 (GCVE-0-2026-45690)
Vulnerability from cvelistv5 – Published: 2026-06-01 17:08 – Updated: 2026-06-02 12:49
VLAI
EPSS
VEX
Title
Nextcloud: Two-Factor Authentication Bypass via Pending Session Token Replay
Summary
Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, an authentication bypass vulnerability allowed attackers with knowledge of a user's password to circumvent two-factor authentication (2FA) protections. When a user initiated login with valid credentials on a 2FA-enabled account, the system created a temporary session token before enforcing the second factor challenge. This token could be extracted and replayed via HTTP Basic Authentication to gain unauthorized access to authenticated endpoints. It is recommended that the Nextcloud Server is upgraded to 33.0.3 or 32.0.9. It is recommended that the Nextcloud Enterprise Server is upgraded to 33.0.3, 32.0.9, 31.0.14.5, 30.0.17.9 or 29.0.16.16
Severity
5.9 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-02 12:48 UTC
CWE
- CWE-287 - Improper Authentication
Assigner
GitHub_M
CNA
References
3 references
| URL | Tags |
|---|---|
| https://github.com/nextcloud/security-advisories/… | x_refsource_CONFIRM |
| https://github.com/nextcloud/server/pull/59758 | x_refsource_MISC |
| https://hackerone.com/reports/3639301 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| nextcloud | security-advisories |
Affected:
>= 32.0.0, < 32.0.9
Affected: >= 33.0.0, < 33.0.3 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-45690",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-02T12:48:56.930426Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-02T12:49:10.334Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "security-advisories",
"vendor": "nextcloud",
"versions": [
{
"status": "affected",
"version": "\u003e= 32.0.0, \u003c 32.0.9"
},
{
"status": "affected",
"version": "\u003e= 33.0.0, \u003c 33.0.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, an authentication bypass vulnerability allowed attackers with knowledge of a user\u0027s password to circumvent two-factor authentication (2FA) protections. When a user initiated login with valid credentials on a 2FA-enabled account, the system created a temporary session token before enforcing the second factor challenge. This token could be extracted and replayed via HTTP Basic Authentication to gain unauthorized access to authenticated endpoints. It is recommended that the Nextcloud Server is upgraded to 33.0.3 or 32.0.9. It is recommended that the Nextcloud Enterprise Server is upgraded to 33.0.3, 32.0.9, 31.0.14.5, 30.0.17.9 or 29.0.16.16"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "CWE-287: Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-01T17:08:04.857Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-jgcj-v42r-9922",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-jgcj-v42r-9922"
},
{
"name": "https://github.com/nextcloud/server/pull/59758",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/nextcloud/server/pull/59758"
},
{
"name": "https://hackerone.com/reports/3639301",
"tags": [
"x_refsource_MISC"
],
"url": "https://hackerone.com/reports/3639301"
}
],
"source": {
"advisory": "GHSA-jgcj-v42r-9922",
"discovery": "UNKNOWN"
},
"title": "Nextcloud: Two-Factor Authentication Bypass via Pending Session Token Replay"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-45690",
"datePublished": "2026-06-01T17:08:04.857Z",
"dateReserved": "2026-05-13T04:38:01.164Z",
"dateUpdated": "2026-06-02T12:49:10.334Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45545 (GCVE-0-2026-45545)
Vulnerability from cvelistv5 – Published: 2026-06-01 17:05 – Updated: 2026-06-02 15:23
VLAI
EPSS
VEX
Title
Nextcloud: SQL Injection in Column Type Parameter Allows Arbitrary SQL Execution
Summary
Nextcloud is an open source content collaboration platform. From versions 0.7.0 to before 0.7.7, 0.8.0 to before 0.8.10, 0.9.0 to before 0.9.8, and 1.0.0 to before 1.0.4, an authenticated attacker with access to the Tables app may be able to execute arbitrary up to 20 bytes long SQL queries, through a stored injection. With carefully crafted input it is possible to break out of the length limitation. The attacker could use this to extract information from the database, or modify data. This issue has been patched in versions 0.7.7, 0.8.10, 0.9.8, 1.0.4, and 2.0.0.
Severity
8.2 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-02 15:23 UTC
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Assigner
GitHub_M
CNA
References
3 references
| URL | Tags |
|---|---|
| https://github.com/nextcloud/security-advisories/… | x_refsource_CONFIRM |
| https://github.com/nextcloud/tables/pull/2309 | x_refsource_MISC |
| https://hackerone.com/reports/3462991 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| nextcloud | security-advisories |
Affected:
>= 0.7.0, < 0.7.7
Affected: >= 0.8.0, < 0.8.10 Affected: >= 0.9.0, < 0.9.8 Affected: >= 1.0.0, < 1.0.4 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-45545",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-02T15:23:14.033691Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-02T15:23:30.574Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "security-advisories",
"vendor": "nextcloud",
"versions": [
{
"status": "affected",
"version": "\u003e= 0.7.0, \u003c 0.7.7"
},
{
"status": "affected",
"version": "\u003e= 0.8.0, \u003c 0.8.10"
},
{
"status": "affected",
"version": "\u003e= 0.9.0, \u003c 0.9.8"
},
{
"status": "affected",
"version": "\u003e= 1.0.0, \u003c 1.0.4"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Nextcloud is an open source content collaboration platform. From versions 0.7.0 to before 0.7.7, 0.8.0 to before 0.8.10, 0.9.0 to before 0.9.8, and 1.0.0 to before 1.0.4, an authenticated attacker with access to the Tables app may be able to execute arbitrary up to 20 bytes long SQL queries, through a stored injection. With carefully crafted input it is possible to break out of the length limitation. The attacker could use this to extract information from the database, or modify data. This issue has been patched in versions 0.7.7, 0.8.10, 0.9.8, 1.0.4, and 2.0.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-01T17:05:18.396Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-x43f-gmgh-vvjj",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-x43f-gmgh-vvjj"
},
{
"name": "https://github.com/nextcloud/tables/pull/2309",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/nextcloud/tables/pull/2309"
},
{
"name": "https://hackerone.com/reports/3462991",
"tags": [
"x_refsource_MISC"
],
"url": "https://hackerone.com/reports/3462991"
}
],
"source": {
"advisory": "GHSA-x43f-gmgh-vvjj",
"discovery": "UNKNOWN"
},
"title": "Nextcloud: SQL Injection in Column Type Parameter Allows Arbitrary SQL Execution"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-45545",
"datePublished": "2026-06-01T17:05:18.396Z",
"dateReserved": "2026-05-12T17:48:47.879Z",
"dateUpdated": "2026-06-02T15:23:30.574Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45544 (GCVE-0-2026-45544)
Vulnerability from cvelistv5 – Published: 2026-06-01 17:03 – Updated: 2026-06-01 21:40
VLAI
EPSS
VEX
Title
Nextcloud: Information Disclosure of view filter metdata via Broken Sensitive Data Masking in ViewService
Summary
Nextcloud is an open source content collaboration platform. From version 0.8.0 to before version 1.0.4, the view filter criteria is exposed to users with read-only permissions in Nextcloud Tables. This issue has been patched in versions 1.0.4 and 2.0.0.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-01 21:39 UTC
CWE
- CWE-1230 - Exposure of Sensitive Information Through Metadata
Assigner
GitHub_M
CNA
References
3 references
| URL | Tags |
|---|---|
| https://github.com/nextcloud/security-advisories/… | x_refsource_CONFIRM |
| https://github.com/nextcloud/tables/pull/2312 | x_refsource_MISC |
| https://hackerone.com/reports/3483753 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| nextcloud | security-advisories |
Affected:
>= 0.8.0, < 1.0.4
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-45544",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-01T21:39:59.421765Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-01T21:40:07.823Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "security-advisories",
"vendor": "nextcloud",
"versions": [
{
"status": "affected",
"version": "\u003e= 0.8.0, \u003c 1.0.4"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Nextcloud is an open source content collaboration platform. From version 0.8.0 to before version 1.0.4, the view filter criteria is exposed to users with read-only permissions in Nextcloud Tables. This issue has been patched in versions 1.0.4 and 2.0.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1230",
"description": "CWE-1230: Exposure of Sensitive Information Through Metadata",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-01T17:03:06.911Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-vvxm-6jjp-m9mp",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-vvxm-6jjp-m9mp"
},
{
"name": "https://github.com/nextcloud/tables/pull/2312",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/nextcloud/tables/pull/2312"
},
{
"name": "https://hackerone.com/reports/3483753",
"tags": [
"x_refsource_MISC"
],
"url": "https://hackerone.com/reports/3483753"
}
],
"source": {
"advisory": "GHSA-vvxm-6jjp-m9mp",
"discovery": "UNKNOWN"
},
"title": "Nextcloud: Information Disclosure of view filter metdata via Broken Sensitive Data Masking in ViewService"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-45544",
"datePublished": "2026-06-01T17:03:06.911Z",
"dateReserved": "2026-05-12T17:48:47.879Z",
"dateUpdated": "2026-06-01T21:40:07.823Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45543 (GCVE-0-2026-45543)
Vulnerability from cvelistv5 – Published: 2026-06-01 17:00 – Updated: 2026-06-01 19:33
VLAI
EPSS
VEX
Title
Nextcloud: Deleting a Forms collaborator share leaves uploaded response files accessible through a lingering Files share
Summary
Nextcloud is an open source content collaboration platform. From version 4.3.0 to before version 5.2.7, a removed collaborator retains unauthorized read access to uploaded respondent files for the affected form. The scope is limited to uploaded files for forms where that user previously had results access. This issue has been patched in version 5.2.7.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-01 19:33 UTC
CWE
- CWE-552 - Files or Directories Accessible to External Parties
Assigner
GitHub_M
CNA
References
3 references
| URL | Tags |
|---|---|
| https://github.com/nextcloud/security-advisories/… | x_refsource_CONFIRM |
| https://github.com/nextcloud/forms/pull/3291 | x_refsource_MISC |
| https://hackerone.com/reports/3617352 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| nextcloud | security-advisories |
Affected:
>= 4.3.0, < 5.2.7
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-45543",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-01T19:33:00.290011Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-01T19:33:14.762Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "security-advisories",
"vendor": "nextcloud",
"versions": [
{
"status": "affected",
"version": "\u003e= 4.3.0, \u003c 5.2.7"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Nextcloud is an open source content collaboration platform. From version 4.3.0 to before version 5.2.7, a removed collaborator retains unauthorized read access to uploaded respondent files for the affected form. The scope is limited to uploaded files for forms where that user previously had results access. This issue has been patched in version 5.2.7."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-552",
"description": "CWE-552: Files or Directories Accessible to External Parties",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-01T17:00:48.861Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-q4fw-6jf8-5vhh",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-q4fw-6jf8-5vhh"
},
{
"name": "https://github.com/nextcloud/forms/pull/3291",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/nextcloud/forms/pull/3291"
},
{
"name": "https://hackerone.com/reports/3617352",
"tags": [
"x_refsource_MISC"
],
"url": "https://hackerone.com/reports/3617352"
}
],
"source": {
"advisory": "GHSA-q4fw-6jf8-5vhh",
"discovery": "UNKNOWN"
},
"title": "Nextcloud: Deleting a Forms collaborator share leaves uploaded response files accessible through a lingering Files share"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-45543",
"datePublished": "2026-06-01T17:00:48.861Z",
"dateReserved": "2026-05-12T17:48:47.879Z",
"dateUpdated": "2026-06-01T19:33:14.762Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45286 (GCVE-0-2026-45286)
Vulnerability from cvelistv5 – Published: 2026-06-01 16:59 – Updated: 2026-06-01 19:13
VLAI
EPSS
VEX
Title
Nextcloud: Calendar app leaked user identifiers via attendee suggestion endpoint
Summary
Nextcloud is an open source content collaboration platform. From versions 5.5.13 to before 5.5.17, and 6.2.0 to before 6.2.3, an authenticated user can enumerate users on the same Nextcloud instance by using the Calendar app's endpoint for suggesting attendees. The sharing restrictions, applied to other endpoints, were not effective here. This issue has been patched in versions 5.5.17 and 6.2.3.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-01 19:12 UTC
CWE
- CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Assigner
GitHub_M
CNA
References
4 references
| URL | Tags |
|---|---|
| https://github.com/nextcloud/security-advisories/… | x_refsource_CONFIRM |
| https://github.com/nextcloud/calendar/issues/7971 | x_refsource_MISC |
| https://github.com/nextcloud/calendar/pull/8197 | x_refsource_MISC |
| https://hackerone.com/reports/3540663 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| nextcloud | security-advisories |
Affected:
>= 5.5.13, < 5.5.17
Affected: >= 6.2.0, < 6.2.3 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-45286",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-01T19:12:56.174122Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-01T19:13:25.363Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "security-advisories",
"vendor": "nextcloud",
"versions": [
{
"status": "affected",
"version": "\u003e= 5.5.13, \u003c 5.5.17"
},
{
"status": "affected",
"version": "\u003e= 6.2.0, \u003c 6.2.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Nextcloud is an open source content collaboration platform. From versions 5.5.13 to before 5.5.17, and 6.2.0 to before 6.2.3, an authenticated user can enumerate users on the same Nextcloud instance by using the Calendar app\u0027s endpoint for suggesting attendees. The sharing restrictions, applied to other endpoints, were not effective here. This issue has been patched in versions 5.5.17 and 6.2.3."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-01T16:59:36.865Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-r697-74m9-gvf2",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-r697-74m9-gvf2"
},
{
"name": "https://github.com/nextcloud/calendar/issues/7971",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/nextcloud/calendar/issues/7971"
},
{
"name": "https://github.com/nextcloud/calendar/pull/8197",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/nextcloud/calendar/pull/8197"
},
{
"name": "https://hackerone.com/reports/3540663",
"tags": [
"x_refsource_MISC"
],
"url": "https://hackerone.com/reports/3540663"
}
],
"source": {
"advisory": "GHSA-r697-74m9-gvf2",
"discovery": "UNKNOWN"
},
"title": "Nextcloud: Calendar app leaked user identifiers via attendee suggestion endpoint"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-45286",
"datePublished": "2026-06-01T16:59:36.865Z",
"dateReserved": "2026-05-11T20:14:43.200Z",
"dateUpdated": "2026-06-01T19:13:25.363Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CERTFR-2026-AVI-1392
Vulnerability from certfr_avis - Published: 2026-10-27 - Updated: 2026-10-27
De multiples vulnérabilités ont été découvertes dans les produits Nextcloud. Certaines d'entre elles permettent à un attaquant de provoquer un déni de service à distance, une atteinte à la confidentialité des données et un contournement de la politique de sécurité.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Nextcloud | Server | Server versions 28.0.x antérieures à 28.0.15 pour nextcloud | ||
| Nextcloud | Server | Server versions 29.0.x antérieures à 29.0.16.19 pour nextcloud entreprise | ||
| Nextcloud | Server | Server versions 24.0.x antérieures à 24.0.13 pour nextcloud | ||
| Nextcloud | Server | Server versions 34.0.x antérieures à 34.0.2 pour nextcloud entreprise | ||
| Nextcloud | Server | Server versions 32.0.x antérieures à 32.0.13 pour nextcloud | ||
| Nextcloud | Server | Server versions 29.0.x antérieures à 29.0.17 pour nextcloud | ||
| Nextcloud | Server | Server versions 33.0.x antérieures à 33.0.7 pour nextcloud enterprise | ||
| Nextcloud | Files Confidential | Files Confidential versions postérieures à 4.0.0 et antérieures à 4.1.1 pour nextcloud | ||
| Nextcloud | Server | Server versions 24.0.x antérieures à 24.0.12.37 pour nextcloud entreprise | ||
| Nextcloud | Server | Server versions 34.0.x antérieures à 34.0.2 pour nextcloud | ||
| Nextcloud | Server | Server versions 26.0.x antérieures à 26.0.13.29 pour nextcloud entreprise | ||
| Nextcloud | Richdocuments | Richdocuments versions 11.0.x antérieures à 11.0.1 pour nextcloud | ||
| Nextcloud | Server | Server versions 27.x antérieures à 27.1.12 pour nextcloud | ||
| Nextcloud | Server | Server versions 27.x antérieures à 27.1.11.29 pour nextcloud entreprise | ||
| Nextcloud | Richdocuments | Richdocuments versions postérieures à 10.0.0 et antérieures à 10.2.1 pour nextcloud | ||
| Nextcloud | Server | Server versions 32.0.x antérieures à 32.0.13 pour nextcloud entreprise | ||
| Nextcloud | Server | Server versions 33.0.x antérieures à 33.0.7 pour nextcloud | ||
| Nextcloud | Server | Server versions 31.0.x antérieures à 31.0.14.8 pour nextcloud entreprise | ||
| Nextcloud | Files Confidential | Files Confidential versions postérieures à 5.0.0 et antérieures à 5.1.0 pour nextcloud | ||
| Nextcloud | Richdocuments | Richdocuments versions postérieures à 9.0.0 et antérieures à 9.1.1 pour nextcloud | ||
| Nextcloud | Server | Server versions 22.x antérieures à 22.2.11 pour nextcloud | ||
| Nextcloud | Server | Server versions 23.0.x antérieures à 23.0.12.38 pour nextcloud entreprise | ||
| Nextcloud | Server | Server versions 23.0.x antérieures à 23.0.13 pour nextcloud | ||
| Nextcloud | Server | Server versions 25.0.x antérieures à 25.0.13.32 pour nextcloud entreprise | ||
| Nextcloud | Server | Server versions 30.0.x antérieures à 30.0.17.12 pour nextcloud entreprise | ||
| Nextcloud | Server | Server versions 26.0.x antérieures à 26.0.14 pour nextcloud | ||
| Nextcloud | Server | Server versions 22.x antérieures à 22.2.10.42 pour nextcloud entreprise | ||
| Nextcloud | Server | Server versions 30.0.x antérieures à 30.0.18 pour nextcloud | ||
| Nextcloud | Collectives | Collectives versions postérieures à 4.0.0 et antérieures à 4.4.0 pour nextcloud | ||
| Nextcloud | Server | Server versions 25.0.x antérieures à 25.0.14 pour nextcloud | ||
| Nextcloud | Files Confidential | Files Confidential versions 3.3.x antérieures à 3.3.1 pour nextcloud | ||
| Nextcloud | Server | Server versions 31.0.x antérieures à 31.0.15 pour nextcloud | ||
| Nextcloud | Server | Server versions 28.0.x antérieures à 28.0.14.20 pour nextcloud entreprise |
References
| Title | Publication Time | Tags | ||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Server versions 28.0.x ant\u00e9rieures \u00e0 28.0.15 pour nextcloud",
"product": {
"name": "Server",
"vendor": {
"name": "Nextcloud",
"scada": false
}
}
},
{
"description": "Server versions 29.0.x ant\u00e9rieures \u00e0 29.0.16.19 pour nextcloud entreprise",
"product": {
"name": "Server",
"vendor": {
"name": "Nextcloud",
"scada": false
}
}
},
{
"description": "Server versions 24.0.x ant\u00e9rieures \u00e0 24.0.13 pour nextcloud",
"product": {
"name": "Server",
"vendor": {
"name": "Nextcloud",
"scada": false
}
}
},
{
"description": "Server versions 34.0.x ant\u00e9rieures \u00e0 34.0.2 pour nextcloud entreprise",
"product": {
"name": "Server",
"vendor": {
"name": "Nextcloud",
"scada": false
}
}
},
{
"description": "Server versions 32.0.x ant\u00e9rieures \u00e0 32.0.13 pour nextcloud",
"product": {
"name": "Server",
"vendor": {
"name": "Nextcloud",
"scada": false
}
}
},
{
"description": "Server versions 29.0.x ant\u00e9rieures \u00e0 29.0.17 pour nextcloud",
"product": {
"name": "Server",
"vendor": {
"name": "Nextcloud",
"scada": false
}
}
},
{
"description": "Server versions 33.0.x ant\u00e9rieures \u00e0 33.0.7 pour nextcloud enterprise",
"product": {
"name": "Server",
"vendor": {
"name": "Nextcloud",
"scada": false
}
}
},
{
"description": "Files Confidential versions post\u00e9rieures \u00e0 4.0.0 et ant\u00e9rieures \u00e0 4.1.1 pour nextcloud",
"product": {
"name": "Files Confidential",
"vendor": {
"name": "Nextcloud",
"scada": false
}
}
},
{
"description": "Server versions 24.0.x ant\u00e9rieures \u00e0 24.0.12.37 pour nextcloud entreprise",
"product": {
"name": "Server",
"vendor": {
"name": "Nextcloud",
"scada": false
}
}
},
{
"description": "Server versions 34.0.x ant\u00e9rieures \u00e0 34.0.2 pour nextcloud",
"product": {
"name": "Server",
"vendor": {
"name": "Nextcloud",
"scada": false
}
}
},
{
"description": "Server versions 26.0.x ant\u00e9rieures \u00e0 26.0.13.29 pour nextcloud entreprise",
"product": {
"name": "Server",
"vendor": {
"name": "Nextcloud",
"scada": false
}
}
},
{
"description": "Richdocuments versions 11.0.x ant\u00e9rieures \u00e0 11.0.1 pour nextcloud",
"product": {
"name": "Richdocuments",
"vendor": {
"name": "Nextcloud",
"scada": false
}
}
},
{
"description": "Server versions 27.x ant\u00e9rieures \u00e0 27.1.12 pour nextcloud",
"product": {
"name": "Server",
"vendor": {
"name": "Nextcloud",
"scada": false
}
}
},
{
"description": "Server versions 27.x ant\u00e9rieures \u00e0 27.1.11.29 pour nextcloud entreprise",
"product": {
"name": "Server",
"vendor": {
"name": "Nextcloud",
"scada": false
}
}
},
{
"description": "Richdocuments versions post\u00e9rieures \u00e0 10.0.0 et ant\u00e9rieures \u00e0 10.2.1 pour nextcloud",
"product": {
"name": "Richdocuments",
"vendor": {
"name": "Nextcloud",
"scada": false
}
}
},
{
"description": "Server versions 32.0.x ant\u00e9rieures \u00e0 32.0.13 pour nextcloud entreprise",
"product": {
"name": "Server",
"vendor": {
"name": "Nextcloud",
"scada": false
}
}
},
{
"description": "Server versions 33.0.x ant\u00e9rieures \u00e0 33.0.7 pour nextcloud",
"product": {
"name": "Server",
"vendor": {
"name": "Nextcloud",
"scada": false
}
}
},
{
"description": "Server versions 31.0.x ant\u00e9rieures \u00e0 31.0.14.8 pour nextcloud entreprise",
"product": {
"name": "Server",
"vendor": {
"name": "Nextcloud",
"scada": false
}
}
},
{
"description": "Files Confidential versions post\u00e9rieures \u00e0 5.0.0 et ant\u00e9rieures \u00e0 5.1.0 pour nextcloud",
"product": {
"name": "Files Confidential",
"vendor": {
"name": "Nextcloud",
"scada": false
}
}
},
{
"description": "Richdocuments versions post\u00e9rieures \u00e0 9.0.0 et ant\u00e9rieures \u00e0 9.1.1 pour nextcloud",
"product": {
"name": "Richdocuments",
"vendor": {
"name": "Nextcloud",
"scada": false
}
}
},
{
"description": "Server versions 22.x ant\u00e9rieures \u00e0 22.2.11 pour nextcloud",
"product": {
"name": "Server",
"vendor": {
"name": "Nextcloud",
"scada": false
}
}
},
{
"description": "Server versions 23.0.x ant\u00e9rieures \u00e0 23.0.12.38 pour nextcloud entreprise",
"product": {
"name": "Server",
"vendor": {
"name": "Nextcloud",
"scada": false
}
}
},
{
"description": "Server versions 23.0.x ant\u00e9rieures \u00e0 23.0.13 pour nextcloud",
"product": {
"name": "Server",
"vendor": {
"name": "Nextcloud",
"scada": false
}
}
},
{
"description": "Server versions 25.0.x ant\u00e9rieures \u00e0 25.0.13.32 pour nextcloud entreprise",
"product": {
"name": "Server",
"vendor": {
"name": "Nextcloud",
"scada": false
}
}
},
{
"description": "Server versions 30.0.x ant\u00e9rieures \u00e0 30.0.17.12 pour nextcloud entreprise",
"product": {
"name": "Server",
"vendor": {
"name": "Nextcloud",
"scada": false
}
}
},
{
"description": "Server versions 26.0.x ant\u00e9rieures \u00e0 26.0.14 pour nextcloud",
"product": {
"name": "Server",
"vendor": {
"name": "Nextcloud",
"scada": false
}
}
},
{
"description": "Server versions 22.x ant\u00e9rieures \u00e0 22.2.10.42 pour nextcloud entreprise",
"product": {
"name": "Server",
"vendor": {
"name": "Nextcloud",
"scada": false
}
}
},
{
"description": "Server versions 30.0.x ant\u00e9rieures \u00e0 30.0.18 pour nextcloud",
"product": {
"name": "Server",
"vendor": {
"name": "Nextcloud",
"scada": false
}
}
},
{
"description": "Collectives versions post\u00e9rieures \u00e0 4.0.0 et ant\u00e9rieures \u00e0 4.4.0 pour nextcloud",
"product": {
"name": "Collectives",
"vendor": {
"name": "Nextcloud",
"scada": false
}
}
},
{
"description": "Server versions 25.0.x ant\u00e9rieures \u00e0 25.0.14 pour nextcloud",
"product": {
"name": "Server",
"vendor": {
"name": "Nextcloud",
"scada": false
}
}
},
{
"description": "Files Confidential versions 3.3.x ant\u00e9rieures \u00e0 3.3.1 pour nextcloud",
"product": {
"name": "Files Confidential",
"vendor": {
"name": "Nextcloud",
"scada": false
}
}
},
{
"description": "Server versions 31.0.x ant\u00e9rieures \u00e0 31.0.15 pour nextcloud",
"product": {
"name": "Server",
"vendor": {
"name": "Nextcloud",
"scada": false
}
}
},
{
"description": "Server versions 28.0.x ant\u00e9rieures \u00e0 28.0.14.20 pour nextcloud entreprise",
"product": {
"name": "Server",
"vendor": {
"name": "Nextcloud",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2026-67400",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-67400"
},
{
"name": "CVE-2026-77173",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-77173"
},
{
"name": "CVE-2026-77167",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-77167"
},
{
"name": "CVE-2026-77171",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-77171"
},
{
"name": "CVE-2026-77172",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-77172"
},
{
"name": "CVE-2026-114601",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-114601"
}
],
"initial_release_date": "2026-10-27T00:00:00",
"last_revision_date": "2026-10-27T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-1392",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-10-27T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Nextcloud. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer un d\u00e9ni de service \u00e0 distance, une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et un contournement de la politique de s\u00e9curit\u00e9.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Nextcloud",
"vendor_advisories": [
{
"published_at": "2026-10-27",
"title": "Bulletin de s\u00e9curit\u00e9 Nextcloud GHSA-p9qq-6vpv-x7wj",
"url": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-p9qq-6vpv-x7wj"
},
{
"published_at": "2026-10-27",
"title": "Bulletin de s\u00e9curit\u00e9 Nextcloud GHSA-w7pp-8m7c-555c",
"url": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-w7pp-8m7c-555c"
},
{
"published_at": "2026-10-27",
"title": "Bulletin de s\u00e9curit\u00e9 Nextcloud GHSA-5572-968j-v7g5",
"url": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-5572-968j-v7g5"
},
{
"published_at": "2026-10-27",
"title": "Bulletin de s\u00e9curit\u00e9 Nextcloud GHSA-qwm4-h3xh-gmvc",
"url": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-qwm4-h3xh-gmvc"
},
{
"published_at": "2026-10-27",
"title": "Bulletin de s\u00e9curit\u00e9 Nextcloud GHSA-x4hv-m8g6-5cj4",
"url": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-x4hv-m8g6-5cj4"
},
{
"published_at": "2026-10-27",
"title": "Bulletin de s\u00e9curit\u00e9 Nextcloud GHSA-6m4h-j3wr-v388",
"url": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-6m4h-j3wr-v388"
}
]
}
CERTFR-2026-AVI-1283
Vulnerability from certfr_avis - Published: 2026-10-09 - Updated: 2026-10-09
De multiples vulnérabilités ont été découvertes dans les produits Nextcloud. Certaines d'entre elles permettent à un attaquant de provoquer une élévation de privilèges, un déni de service à distance et une atteinte à la confidentialité des données.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Nextcloud | N/A | Team Folders versions 21.x antérieures à 21.0.8 | ||
| Nextcloud | Server | Server versions 33.0.x antérieures à 33.0.6 | ||
| Nextcloud | Server | Server versions 34.0.x antérieures à 34.0.1 | ||
| Nextcloud | N/A | Team Folders versions 20.x et antérieures à 20.1.15 | ||
| Nextcloud | N/A | Collectives versions antérieures à 4.4.1 | ||
| Nextcloud | N/A | Team Folders versions 14.x antérieures à 14.0.12 | ||
| Nextcloud | N/A | Team Folders versions 15.x et antérieures à 15.3.13 | ||
| Nextcloud | N/A | Team Folders versions antérieures à 13.1.8 | ||
| Nextcloud | N/A | Team Folders versions 18.x et antérieures à 18.1.14 | ||
| Nextcloud | N/A | Team Folders versions 16.x antérieures à 16.0.16 | ||
| Nextcloud | N/A | Team Folders versions 19.x antérieures à 19.1.19 | ||
| Nextcloud | N/A | Team Folders versions 17.x antérieures à 17.0.16 | ||
| Nextcloud | N/A | Team Folders versions 22.x antérieures à 22.0.1 | ||
| Nextcloud | Server | Server versions 32.0.x antérieures à 32.0.12 pour nextcloud | ||
| Nextcloud | N/A | files_lock versions 33.0.x antérieures à 33.0.6 |
References
| Title | Publication Time | Tags | |||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Team Folders versions 21.x ant\u00e9rieures \u00e0 21.0.8",
"product": {
"name": "N/A",
"vendor": {
"name": "Nextcloud",
"scada": false
}
}
},
{
"description": "Server versions 33.0.x ant\u00e9rieures \u00e0 33.0.6",
"product": {
"name": "Server",
"vendor": {
"name": "Nextcloud",
"scada": false
}
}
},
{
"description": "Server versions 34.0.x ant\u00e9rieures \u00e0 34.0.1",
"product": {
"name": "Server",
"vendor": {
"name": "Nextcloud",
"scada": false
}
}
},
{
"description": "Team Folders versions 20.x et ant\u00e9rieures \u00e0 20.1.15",
"product": {
"name": "N/A",
"vendor": {
"name": "Nextcloud",
"scada": false
}
}
},
{
"description": "Collectives versions ant\u00e9rieures \u00e0 4.4.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Nextcloud",
"scada": false
}
}
},
{
"description": "Team Folders versions 14.x ant\u00e9rieures \u00e0 14.0.12",
"product": {
"name": "N/A",
"vendor": {
"name": "Nextcloud",
"scada": false
}
}
},
{
"description": "Team Folders versions 15.x et ant\u00e9rieures \u00e0 15.3.13",
"product": {
"name": "N/A",
"vendor": {
"name": "Nextcloud",
"scada": false
}
}
},
{
"description": "Team Folders versions ant\u00e9rieures \u00e0 13.1.8",
"product": {
"name": "N/A",
"vendor": {
"name": "Nextcloud",
"scada": false
}
}
},
{
"description": "Team Folders versions 18.x et ant\u00e9rieures \u00e0 18.1.14",
"product": {
"name": "N/A",
"vendor": {
"name": "Nextcloud",
"scada": false
}
}
},
{
"description": "Team Folders versions 16.x ant\u00e9rieures \u00e0 16.0.16",
"product": {
"name": "N/A",
"vendor": {
"name": "Nextcloud",
"scada": false
}
}
},
{
"description": "Team Folders versions 19.x ant\u00e9rieures \u00e0 19.1.19",
"product": {
"name": "N/A",
"vendor": {
"name": "Nextcloud",
"scada": false
}
}
},
{
"description": "Team Folders versions 17.x ant\u00e9rieures \u00e0 17.0.16",
"product": {
"name": "N/A",
"vendor": {
"name": "Nextcloud",
"scada": false
}
}
},
{
"description": "Team Folders versions 22.x ant\u00e9rieures \u00e0 22.0.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Nextcloud",
"scada": false
}
}
},
{
"description": "Server versions 32.0.x ant\u00e9rieures \u00e0 32.0.12 pour nextcloud",
"product": {
"name": "Server",
"vendor": {
"name": "Nextcloud",
"scada": false
}
}
},
{
"description": "files_lock versions 33.0.x ant\u00e9rieures \u00e0 33.0.6",
"product": {
"name": "N/A",
"vendor": {
"name": "Nextcloud",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2026-82985",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-82985"
},
{
"name": "CVE-2026-68493",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68493"
},
{
"name": "CVE-2026-77169",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-77169"
},
{
"name": "CVE-2026-77165",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-77165"
},
{
"name": "CVE-2026-77166",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-77166"
}
],
"initial_release_date": "2026-10-09T00:00:00",
"last_revision_date": "2026-10-09T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-1283",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-10-09T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Nextcloud. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une \u00e9l\u00e9vation de privil\u00e8ges, un d\u00e9ni de service \u00e0 distance et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Nextcloud",
"vendor_advisories": [
{
"published_at": "2026-10-08",
"title": "Bulletin de s\u00e9curit\u00e9 Nextcloud GHSA-f99w-3pm7-v4cv",
"url": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-f99w-3pm7-v4cv"
},
{
"published_at": "2026-10-08",
"title": "Bulletin de s\u00e9curit\u00e9 Nextcloud GHSA-4vpp-fp9q-9g23",
"url": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-4vpp-fp9q-9g23"
},
{
"published_at": "2026-10-08",
"title": "Bulletin de s\u00e9curit\u00e9 Nextcloud GHSA-5gv7-hw69-w6px",
"url": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-5gv7-hw69-w6px"
},
{
"published_at": "2026-10-08",
"title": "Bulletin de s\u00e9curit\u00e9 Nextcloud GHSA-9mjh-89xm-hcqw",
"url": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-9mjh-89xm-hcqw"
},
{
"published_at": "2026-10-08",
"title": "Bulletin de s\u00e9curit\u00e9 Nextcloud GHSA-22w9-gpgv-pcgc",
"url": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-22w9-gpgv-pcgc"
}
]
}
CERTFR-2026-AVI-1198
Vulnerability from certfr_avis - Published: 2026-09-17 - Updated: 2026-09-17
Une vulnérabilité a été découverte dans Nextcloud Server. Elle permet à un attaquant de provoquer une exécution de code arbitraire à distance.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Nextcloud | Server | Server versions 33.0.x antérieures à 33.0.7 pour nextcloud et nextcloud enterprise | ||
| Nextcloud | Server | Server versions 30.0.x antérieures à 30.0.17.12 pour nextcloud enterprise | ||
| Nextcloud | Server | Server versions 23.0.x antérieures à 23.0.12.38 pour nextcloud enterprise | ||
| Nextcloud | Server | Server versions 28.0.x antérieures à 28.0.14.20 pour nextcloud enterprise | ||
| Nextcloud | Server | Server versions 24.0.x antérieures à 24.0.13.37 pour nextcloud enterprise | ||
| Nextcloud | Server | Server versions 31.0.x antérieures à 31.0.14.8 pour nextcloud enterprise | ||
| Nextcloud | Server | Server versions 25.0.x antérieures à 25.0.13.32 pour nextcloud enterprise | ||
| Nextcloud | Server | Server versions 32.0.x antérieures à 32.0.13 pour nextcloud et nextcloud enterprise | ||
| Nextcloud | Server | Server versions 29.0.x antérieures à 29.0.16.19 pour nextcloud enterprise | ||
| Nextcloud | Server | Server versions 22.x antérieures à 22.2.10.42 pour nextcloud enterprise | ||
| Nextcloud | Server | Server versions 27.x et antérieures à 27.1.11.29 pour nextcloud enterprise | ||
| Nextcloud | Server | Server versions 34.0.x antérieures à 34.0.2 pour nextcloud et nextcloud enterprise | ||
| Nextcloud | Server | Server versions 26.0.x antérieures à 26.0.13.29 pour nextcloud enterprise |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Server versions 33.0.x ant\u00e9rieures \u00e0 33.0.7 pour nextcloud et nextcloud enterprise",
"product": {
"name": "Server",
"vendor": {
"name": "Nextcloud",
"scada": false
}
}
},
{
"description": "Server versions 30.0.x ant\u00e9rieures \u00e0 30.0.17.12 pour nextcloud enterprise",
"product": {
"name": "Server",
"vendor": {
"name": "Nextcloud",
"scada": false
}
}
},
{
"description": "Server versions 23.0.x ant\u00e9rieures \u00e0 23.0.12.38 pour nextcloud enterprise",
"product": {
"name": "Server",
"vendor": {
"name": "Nextcloud",
"scada": false
}
}
},
{
"description": "Server versions 28.0.x ant\u00e9rieures \u00e0 28.0.14.20 pour nextcloud enterprise",
"product": {
"name": "Server",
"vendor": {
"name": "Nextcloud",
"scada": false
}
}
},
{
"description": "Server versions 24.0.x ant\u00e9rieures \u00e0 24.0.13.37 pour nextcloud enterprise",
"product": {
"name": "Server",
"vendor": {
"name": "Nextcloud",
"scada": false
}
}
},
{
"description": "Server versions 31.0.x ant\u00e9rieures \u00e0 31.0.14.8 pour nextcloud enterprise",
"product": {
"name": "Server",
"vendor": {
"name": "Nextcloud",
"scada": false
}
}
},
{
"description": "Server versions 25.0.x ant\u00e9rieures \u00e0 25.0.13.32 pour nextcloud enterprise",
"product": {
"name": "Server",
"vendor": {
"name": "Nextcloud",
"scada": false
}
}
},
{
"description": "Server versions 32.0.x ant\u00e9rieures \u00e0 32.0.13 pour nextcloud et nextcloud enterprise",
"product": {
"name": "Server",
"vendor": {
"name": "Nextcloud",
"scada": false
}
}
},
{
"description": "Server versions 29.0.x ant\u00e9rieures \u00e0 29.0.16.19 pour nextcloud enterprise",
"product": {
"name": "Server",
"vendor": {
"name": "Nextcloud",
"scada": false
}
}
},
{
"description": "Server versions 22.x ant\u00e9rieures \u00e0 22.2.10.42 pour nextcloud enterprise",
"product": {
"name": "Server",
"vendor": {
"name": "Nextcloud",
"scada": false
}
}
},
{
"description": "Server versions 27.x et ant\u00e9rieures \u00e0 27.1.11.29 pour nextcloud enterprise",
"product": {
"name": "Server",
"vendor": {
"name": "Nextcloud",
"scada": false
}
}
},
{
"description": "Server versions 34.0.x ant\u00e9rieures \u00e0 34.0.2 pour nextcloud et nextcloud enterprise",
"product": {
"name": "Server",
"vendor": {
"name": "Nextcloud",
"scada": false
}
}
},
{
"description": "Server versions 26.0.x ant\u00e9rieures \u00e0 26.0.13.29 pour nextcloud enterprise",
"product": {
"name": "Server",
"vendor": {
"name": "Nextcloud",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [],
"initial_release_date": "2026-09-17T00:00:00",
"last_revision_date": "2026-09-17T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-1198",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-09-17T00:00:00.000000"
}
],
"risks": [
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
}
],
"summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans Nextcloud Server. Elle permet \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance.",
"title": "Vuln\u00e9rabilit\u00e9 dans Nextcloud Server",
"vendor_advisories": [
{
"published_at": "2026-09-17",
"title": "Bulletin de s\u00e9curit\u00e9 Nextcloud GHSA-7hwf-8pcj-33h4",
"url": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-7hwf-8pcj-33h4"
}
]
}
CERTFR-2026-AVI-0973
Vulnerability from certfr_avis - Published: 2026-08-06 - Updated: 2026-08-06
De multiples vulnérabilités ont été découvertes dans les produits Nextcloud. Elles permettent à un attaquant de provoquer une atteinte à la confidentialité des données et un contournement de la politique de sécurité.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Nextcloud | Mail versions 4.x et 5.x antérieures à 5.5.16 | |||
| Nextcloud | Mail versions 5.7.x antérieures à 5.7.13 | |||
| Nextcloud | Mail versions 3.5.x à 3.7.x antérieures à 3.7.25 | |||
| Nextcloud | Server | Server versions 32.0.10 à 32.0.x antérieures à 32.0.12 pour nextcloud et nextcloud enterprise | ||
| Nextcloud | Server | Server versions 33.0.4 à 33.0.x antérieures à 33.0.6 pour nextcloud et nextcloud enterprise | ||
| Nextcloud | Server | Server versions 34.0.x antérieures à 34.0.1 pour nextcloud | ||
| Nextcloud | Mail versions 5.6.x antérieures à 5.6.20 |
References
| Title | Publication Time | Tags | ||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Mail versions 4.x et 5.x ant\u00e9rieures \u00e0 5.5.16",
"product": {
"name": "Mail",
"vendor": {
"name": "Nextcloud",
"scada": false
}
}
},
{
"description": "Mail versions 5.7.x ant\u00e9rieures \u00e0 5.7.13",
"product": {
"name": "Mail",
"vendor": {
"name": "Nextcloud",
"scada": false
}
}
},
{
"description": "Mail versions 3.5.x \u00e0 3.7.x ant\u00e9rieures \u00e0 3.7.25",
"product": {
"name": "Mail",
"vendor": {
"name": "Nextcloud",
"scada": false
}
}
},
{
"description": "Server versions 32.0.10 \u00e0 32.0.x ant\u00e9rieures \u00e0 32.0.12 pour nextcloud et nextcloud enterprise",
"product": {
"name": "Server",
"vendor": {
"name": "Nextcloud",
"scada": false
}
}
},
{
"description": "Server versions 33.0.4 \u00e0 33.0.x ant\u00e9rieures \u00e0 33.0.6 pour nextcloud et nextcloud enterprise",
"product": {
"name": "Server",
"vendor": {
"name": "Nextcloud",
"scada": false
}
}
},
{
"description": "Server versions 34.0.x ant\u00e9rieures \u00e0 34.0.1 pour nextcloud",
"product": {
"name": "Server",
"vendor": {
"name": "Nextcloud",
"scada": false
}
}
},
{
"description": "Mail versions 5.6.x ant\u00e9rieures \u00e0 5.6.20",
"product": {
"name": "Mail",
"vendor": {
"name": "Nextcloud",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2026-61545",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-61545"
},
{
"name": "CVE-2026-61527",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-61527"
}
],
"initial_release_date": "2026-08-06T00:00:00",
"last_revision_date": "2026-08-06T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-0973",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-08-06T00:00:00.000000"
}
],
"risks": [
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Nextcloud. Elles permettent \u00e0 un attaquant de provoquer une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et un contournement de la politique de s\u00e9curit\u00e9.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Nextcloud",
"vendor_advisories": [
{
"published_at": "2026-08-05",
"title": "Bulletin de s\u00e9curit\u00e9 Nextcloud GHSA-99gw-ww6p-f2rr",
"url": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-99gw-ww6p-f2rr"
},
{
"published_at": "2026-08-05",
"title": "Bulletin de s\u00e9curit\u00e9 Nextcloud GHSA-vq3v-jv6f-6xp2",
"url": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-vq3v-jv6f-6xp2"
}
]
}