PT-2026-45529 · Nextcloud · Nextcloud

Dorra Jaouad · Published 2026-06-01 · Updated 2026-06-17 · CVE-2026-45285

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Nextcloud versions 32.0.0 through 32.0.8 Nextcloud versions 33.0.0 through 33.0.2

Description When a user shares a folder or file with a Nextcloud Team containing an external member (a person added via email without a Nextcloud account), the system automatically generates a public link for that member. This link is sent via email and grants permissions to read, write, delete, reshare, and download data based on the Team's access level. Because the link is not displayed in the folder's share section, the owner is unaware of its existence and cannot revoke it through the standard sharing interface. An attacker who intercepts or receives this link can access and manipulate the shared data without authentication.

Recommendations Update to version 32.0.9 for versions in the 32.x branch. Update to version 33.0.3 for versions in the 33.x branch.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-45285

Affected Products

Nextcloud

References · 7

• https://github.com/nextcloud/circles/pull/2454 · Patch
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-r3xh-x86g-hw4m · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-45285 · Security Note
• https://twitter.com/dailycve/status/2062375866621895038 · Twitter Post
• https://hackerone.com/reports/3625932 · Note
• https://t.me/cveNotify/165867 · Telegram Post
• https://twitter.com/threatcluster/status/2067291586774323342 · Twitter Post