Nextcloud

Products

Exploited and recent CVEs

• CVE-2026-82984 Medium 4.3 When a team was configured as "visible to everyone", the web UI correctly blocked non-members from viewing the team ("You are not a member of ..."), but the resources API endpoint could still be calle 0.3%
• CVE-2026-77167 High 7.5 Abusing the federated share endpoint, an attacker can write arbitrary rows into the oc_share_external database table. These rows persist indefinitely — there is no automatic cleanup mechanism. Three d 0.4%
• CVE-2026-77173 Medium 4.3 A user could create a docx or odt file with a # in the filename with confidential information such as a credit card number and have it not be marked as confidential. 0.2%
• CVE-2026-67400 Low 3.5 A missing token type check allowed to retrieve more additional information about the WOPI configuration with a user or guest token. 0.2%
• CVE-2026-77171 Low 3.5 A public shared collective always allowed recipients of the link to create pages. 0.2%
• CVE-2026-77172 Medium 5.3 App passwords were allowed to bypass password confirmation on sensitive endpoints. 0.3%
• CVE-2026-87897 Medium 4.6 A SSRF vulnerability found that enables access to internal Chrome Devtools Protocol APIs that can leak the JWT authentication token for another user. A low privileged attacker could continually exploi 0.2%
• CVE-2026-82983 Low 3.3 The Tables app's share-listing endpoint (GET /apps/tables/share/table/{tableId}) did not verify that the requesting user has manage-level permission on the table before returning the full list of shar 0.1%
• CVE-2026-82986 Medium 4.6 The user in a group can bypass the group restriction set by an administrator on link sharing, creating share links for a table even though they shouldn't have that permission. 0.2%
• CVE-2026-77165 Medium 6.5 File owners were unable to unlock TYPE_TOKEN locks placed by other users, leaving files permanently locked with no recovery path outside of the database. 0.4%
• CVE-2026-77166 Low 2.4 The emoji field in the page emoji update endpoint does not properly validate user input. By injecting long text and line breaks, the sidebar layout becomes broken and can hide other items. 0.3%
• CVE-2026-68493 Low 3.1 After guessing a 62^15 complex unique identifier, a malicious logged in user was able to retrieve a list of memberships for a circle they are not a member of. 0.2%
• CVE-2026-77164 Medium 6.2 Circles' remote-instance signature verification fetches the attacker-supplied keyId URL before trust in the remote instance is established, and explicitly allows local/private addresses for this reque 0.2%
• CVE-2026-82985 Medium 6.5 The Photos app's filter-based "smart albums" build their file listing using the search configuration (photosSourceFolders) of the user viewing the album, rather than the album owner's configuration. W 0.4%
• CVE-2026-77170 Medium 4.3 The Deck config API allows authenticated users to set board-scoped configuration keys for arbitrary board IDs without validating whether the user owns or has permission to manage the referenced board. 0.3%
• CVE-2026-82982 Medium 4.3 The Approval app's approve/reject endpoint is meant to require the file's current etag as a freshness check, preventing an approver from approving or rejecting a file whose contents changed after they 0.3%
• CVE-2026-77169 Medium 6.5 A vulnerability in the team folders (formerly group folders) app when used in combination with the workspace app allowed API/REST-only delegated administrators to bypass folder-level authorization con 0.5%
• CVE-2026-82980 Medium 6.3 Any authenticated user can lock or unlock files they do not own by targeting absolute WebDAV paths of other users. The DAV plugin resolves files from the absolute request URI without verifying that th 0.3%
• CVE-2026-45810 Medium 6.8 Nextcloud: Propfind requests for file comments allowed to load comments for other files 0.3%
• CVE-2026-45722 High 7.1 Nextcloud: Tables app allows limited SQLi in ORDER BY with malicious sort order argument for Table Views 0.3%
• CVE-2026-45691 Medium 5.9 Nextcloud: Bypass of second factor authentication on DAV endpoints 0.3%
• CVE-2026-45690 Medium 5.9 Nextcloud: Two-Factor Authentication Bypass via Pending Session Token Replay 0.3%
• CVE-2026-45545 High 8.2 Nextcloud: SQL Injection in Column Type Parameter Allows Arbitrary SQL Execution 0.3%
• CVE-2026-45544 Medium 4.3 Nextcloud: Information Disclosure of view filter metdata via Broken Sensitive Data Masking in ViewService 0.2%
• CVE-2026-45543 Medium 5.3 Nextcloud: Deleting a Forms collaborator share leaves uploaded response files accessible through a lingering Files share 0.3%
• CVE-2026-45286 Medium 4.3 Nextcloud: Calendar app leaked user identifiers via attendee suggestion endpoint 0.3%
• CVE-2026-45284 Medium 4.6 Nextcloud: Wrong condition in the User OIDC app's LdapService allowed deleted LDAP users to authenticate 0.2%
• CVE-2026-45285 Medium 6.4 Nextcloud: Hidden Public Link creation when sharing to a Team External Member 0.3%
• CVE-2026-45283 Medium 6.3 Nextcloud: Files Lock app allows users to lock and unlock files of other users 0.2%
• CVE-2026-45282 Medium 6.5 Nextcloud: Logged-in user bypasses share password and download restrictions on Text attachments via documentId leads to unauthorized file access 0.3%