PT-2026-45527 · Nextcloud · Nextcloud Enterprise Server+1

Dorra Jaouad · Published 2026-06-01 · Updated 2026-06-03 · CVE-2026-45283

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Nextcloud Server versions 32.0.0 through 32.0.1 Nextcloud Server versions 33.0.0 through 33.0.0 Nextcloud Enterprise Server versions prior to 31.0.14.4 Nextcloud Enterprise Server versions 32.0.0 through 32.0.1 Nextcloud Enterprise Server versions 33.0.0 through 33.0.0

Description The files lock app fails to properly validate file ownership when processing DAV lock and unlock requests. An authenticated user can lock or unlock files belonging to other users by targeting their absolute WebDAV paths. Furthermore, lock tokens are disclosed to unauthorized callers within error responses, which enables attackers to remove token-based locks established by other users' client applications.

Recommendations Upgrade to version 32.0.2 or 33.0.1. Upgrade to version 31.0.14.4, 32.0.2, or 33.0.1.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2026-45283

Affected Products

Nextcloud Enterprise Server

Nextcloud Server

References · 5

• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-4chh-6mhf-p4jj · Vendor Advisory
• https://github.com/nextcloud/files_lock/pull/1007 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-45283 · Security Note
• https://t.me/cveNotify/165826 · Telegram Post
• https://hackerone.com/reports/3301553# · Note