PT-2026-45471 · Nextcloud · Nextcloud Server+1

Vidh0411 · CVE-2026-45155 · Published 2026-06-01 · Updated 2026-06-01

Positive Technologies (AI Summary)

CVSS v3.1

2.6

Low

Base vector

AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Nextcloud Server versions 32.0.0 through 32.0.6 Nextcloud Server versions 33.0.0 through 33.0.0 Nextcloud Enterprise Server versions prior to 29.0.16.14 Nextcloud Enterprise Server versions prior to 30.0.17.8 Nextcloud Enterprise Server versions prior to 31.0.14.3 Nextcloud Enterprise Server versions prior to 32.0.7 Nextcloud Enterprise Server versions prior to 33.0.1

Description A missing access check at the API level allows the addition of unknown circles to other circles using their ID. While the default complexity of circle IDs (62^15) makes arbitrary execution unlikely, memberships could be tracked if an ID is obtained from another source.

Recommendations Upgrade Nextcloud Server to version 32.0.7 or 33.0.1. Upgrade Nextcloud Enterprise Server to version 29.0.16.14, 30.0.17.8, 31.0.14.3, 32.0.7, or 33.0.1.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-45155

GHSA-XPGV-GRF9-GM7X

Affected Products

Nextcloud Enterprise Server

Nextcloud Server

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45155.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-45155 · Security Note
• https://osv.dev/vulnerability/CVE-2026-45155 · Vendor Advisory
• https://github.com/nextcloud/circles/pull/2401 · Note
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-xpgv-grf9-gm7x · Note
• https://t.me/CVEtracker/55507 · Telegram Post
• https://hackerone.com/reports/3511998 · Note