Vulnerability · Published Jun 1, 2026 · Assigned by GitHub_M
CVE-2026-45157Nextcloud: Valid share tokens allow to access tempory upload files of share owner
Medium 6.3
In plain English
A medium-severity improper access control in security-advisories from nextcloud. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities).
Official description
Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, when a malicious user has access to a file share of a user, they could use this share token to also access the chunking upload directly and see temporary part files during on going uploads. It is recommended that the Nextcloud Server is upgraded to 32.0.9 or 33.0.3. It is recommended that the Nextcloud Enterprise Server is upgraded to 26.0.13.26, 27.1.11.25, 28.0.14.17, 29.0.16.16, 30.0.17.9, 31.0.14.5, 32.0.9 or 33.0.3
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| nextcloud | security-advisories | >= 32.0.0, < 32.0.9>= 33.0.0, < 33.0.3 |
Weakness: CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N
References
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-45pj-p7x7-4mhc x_refsource_CONFIRM
- https://github.com/nextcloud/server/pull/59780 x_refsource_MISC
- https://hackerone.com/reports/3483708 x_refsource_MISC