Vulnerability · Published Jun 1, 2026 · Assigned by GitHub_M
CVE-2026-45543Nextcloud: Deleting a Forms collaborator share leaves uploaded response files accessible through a lingering Files share
Medium 5.3
In plain English
A medium-severity security flaw in security-advisories from nextcloud. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 19% of all known vulnerabilities).
Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.3%top 80.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Nextcloud is an open source content collaboration platform. From version 4.3.0 to before version 5.2.7, a removed collaborator retains unauthorized read access to uploaded respondent files for the affected form. The scope is limited to uploaded files for forms where that user previously had results access. This issue has been patched in version 5.2.7.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| nextcloud | security-advisories | >= 4.3.0, < 5.2.7 |
Weakness: CWE-552 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
References
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-q4fw-6jf8-5vhh x_refsource_CONFIRM
- https://github.com/nextcloud/forms/pull/3291 x_refsource_MISC
- https://hackerone.com/reports/3617352 x_refsource_MISC