PT-2026-45538 · Nextcloud · Nextcloud Server+1

Dorra Jaouad + 1 · Publicado 2026-06-01 · Atualizado 2026-06-17 · CVE-2026-45810

NVD

CVSS v3.1

6.8

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N

Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 31.0.0 to before 31.0.12, and 32.0.0 to before 32.0.3, a missing check of a relation allowed authenticated users with access to any file comment, to read the content of all comments. It is recommended that the Nextcloud Server is upgraded to 31.0.12 or 32.0.3. It is recommended that the Nextcloud Enterprise Server is upgraded to 21.0.9.20, 22.2.10.35, 23.0.12.31, 24.0.12.30, 25.0.13.25, 26.0.13.22, 27.1.11.22, 28.0.14.13, 29.0.16.10, 30.0.17.5, 31.0.12 or 32.0.3

Correção

IDOR

Enumeração de Fraquezas

CWE-639

Identificadores relacionados

CVE-2026-45810

Produtos afetados

Nextcloud Server

Security-Advisories

Referências · 5

• https://github.com/nextcloud/server/pull/56982 · Correção
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-285v-p9x9-cjhj · Aviso do Fabricante
• https://hackerone.com/reports/3425534 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-45810 · Nota de Segurança
• https://twitter.com/threatcluster/status/2067291586774323342 · Publicação no Twitter