PT-2026-45470 · Nextcloud · Collectives

Yoyomiski · CVE-2026-45154 · Published 2026-06-01 · Updated 2026-06-01

Positive Technologies (AI Summary)

CVSS v3.1

2.6

Low

Base vector

AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Nextcloud versions 2.6.0 through 4.2.x

Description An improper access control issue exists in the Collectives application. When pages within a collective are deleted and the collective is shared with view-only permissions, guests with access to the collective can directly access those deleted pages from the trashbin.

Recommendations Update to version 4.3.0.

Exploit

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2026-45154

GHSA-8MPV-GGQ8-HF3W

Affected Products

Collectives

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45154.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-45154 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-45154 · Security Note
• https://github.com/nextcloud/collectives/pull/2432 · Note
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-8mpv-ggq8-hf3w · Note
• https://hackerone.com/reports/3521434 · Note
• https://t.me/CVEtracker/55506 · Telegram Post