PT-2026-45533 · Nextcloud · Nextcloud+1

Root1856 · Published 2026-06-01 · Updated 2026-06-04 · CVE-2026-45545

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Nextcloud versions 0.7.0 through 0.7.6 Nextcloud versions 0.8.0 through 0.8.9 Nextcloud versions 0.9.0 through 0.9.7 Nextcloud versions 1.0.0 through 1.0.3

Description An authenticated attacker with access to the Tables app can execute arbitrary SQL queries through a stored injection. While queries are typically limited to 20 bytes, carefully crafted input can bypass this length restriction. This allows the attacker to extract information from the database or modify data.

Recommendations Update to version 0.7.7 for versions 0.7.0 through 0.7.6. Update to version 0.8.10 for versions 0.8.0 through 0.8.9. Update to version 0.9.8 for versions 0.9.0 through 0.9.7. Update to version 1.0.4 for versions 1.0.0 through 1.0.3.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-45545

Affected Products

Nextcloud

Tables App

References · 5

• https://github.com/nextcloud/tables/pull/2309 · Patch
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-x43f-gmgh-vvjj · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-45545 · Security Note
• https://hackerone.com/reports/3462991 · Note
• https://t.me/cveNotify/166036 · Telegram Post