PT-2026-45530 · Nextcloud · Nextcloud

Dorra Jaouad + 1 · Published 2026-06-01 · Updated 2026-06-04 · CVE-2026-45286

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Nextcloud versions 5.5.13 through 5.5.16 Nextcloud versions 6.2.0 through 6.2.2

Description An authenticated user can enumerate other users on the same instance. This is possible because sharing restrictions were not effectively applied to the Calendar app's endpoint used for suggesting attendees.

Recommendations Update to version 5.5.17. Update to version 6.2.3.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2026-45286

Affected Products

Nextcloud

References · 7

• https://github.com/nextcloud/calendar/issues/7971 · Patch
• https://github.com/nextcloud/calendar/pull/8197 · Patch
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-r697-74m9-gvf2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-45286 · Security Note
• https://twitter.com/dailycve/status/2062375667132518806 · Twitter Post
• https://hackerone.com/reports/3540663 · Note
• https://t.me/cveNotify/165868 · Telegram Post