PT-2026-45538 · Nextcloud · Nextcloud Server+1

Dorra Jaouad + 1 · CVE-2026-45810 · Published 2026-06-01 · Updated 2026-07-22

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Nextcloud Server versions 31.0.0 through 31.0.11 Nextcloud Server versions 32.0.0 through 32.0.2 Nextcloud Enterprise Server versions prior to 21.0.9.20 Nextcloud Enterprise Server versions prior to 22.2.10.35 Nextcloud Enterprise Server versions prior to 23.0.12.31 Nextcloud Enterprise Server versions prior to 24.0.12.30 Nextcloud Enterprise Server versions prior to 25.0.13.25 Nextcloud Enterprise Server versions prior to 26.0.13.22 Nextcloud Enterprise Server versions prior to 27.1.11.22 Nextcloud Enterprise Server versions prior to 28.0.14.13 Nextcloud Enterprise Server versions prior to 29.0.16.10 Nextcloud Enterprise Server versions prior to 30.0.17.5 Nextcloud Enterprise Server versions prior to 31.0.12 Nextcloud Enterprise Server versions prior to 32.0.3

Description A missing relation check allows authenticated users who have access to any file comment to read the content of all comments.

Recommendations Upgrade Nextcloud Server versions 31.0.0 through 31.0.11 to 31.0.12. Upgrade Nextcloud Server versions 32.0.0 through 32.0.2 to 32.0.3. Upgrade Nextcloud Enterprise Server to 21.0.9.20. Upgrade Nextcloud Enterprise Server to 22.2.10.35. Upgrade Nextcloud Enterprise Server to 23.0.12.31. Upgrade Nextcloud Enterprise Server to 24.0.12.30. Upgrade Nextcloud Enterprise Server to 25.0.13.25. Upgrade Nextcloud Enterprise Server to 26.0.13.22. Upgrade Nextcloud Enterprise Server to 27.1.11.22. Upgrade Nextcloud Enterprise Server to 28.0.14.13. Upgrade Nextcloud Enterprise Server to 29.0.16.10. Upgrade Nextcloud Enterprise Server to 30.0.17.5. Upgrade Nextcloud Enterprise Server to 31.0.12. Upgrade Nextcloud Enterprise Server to 32.0.3.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

BIT-NEXTCLOUD-2026-45810

CVE-2026-45810

GHSA-285V-P9X9-CJHJ

Affected Products

Nextcloud Enterprise Server

Nextcloud Server

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45810.json · Exploit
• https://github.com/nextcloud/server/pull/56982 · Patch
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-285v-p9x9-cjhj · Vendor Advisory
• https://osv.dev/vulnerability/BIT-nextcloud-2026-45810 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-45810 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-45810 · Security Note
• https://hackerone.com/reports/3425534 · Note
• https://t.me/cveNotify/211627 · Telegram Post
• https://twitter.com/threatcluster/status/2067291586774323342 · Twitter Post