PT-2026-45470 · Nextcloud · Collectives

Yoyomiski · Published 2026-06-01 · Updated 2026-06-01 · CVE-2026-45154

Positive Technologies (AI Summary)

CVSS v3.1

2.6

Low

Base vector

AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Nextcloud versions 2.6.0 through 4.2.x

Description An improper access control issue exists in the Collectives application. When pages within a collective are deleted and the collective is shared with view-only permissions, guests with access to the collective can directly access those deleted pages from the trashbin.

Recommendations Update to version 4.3.0.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2026-45154

Affected Products

Collectives

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-45154 · Security Note
• https://github.com/nextcloud/collectives/pull/2432 · Note
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-8mpv-ggq8-hf3w · Note
• https://hackerone.com/reports/3521434 · Note
• https://t.me/CVEtracker/55506 · Telegram Post