Nextcloud vulnerabilities
306 CVEs and advisories name Nextcloud as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-82984When a team was configured as "visible to everyone", the web UI correctly blocked non-members from viewing the team ("You are not a member…
- CVE-2026-77167Abusing the federated share endpoint, an attacker can write arbitrary rows into the oc_share_external database table.
- CVE-2026-77173A user could create a docx or odt file with a # in the filename with confidential information such as a credit card number and have it not…
- CVE-2026-67400A missing token type check allowed to retrieve more additional information about the WOPI configuration with a user or guest token.
- CVE-2026-77171A public shared collective always allowed recipients of the link to create pages.
- CVE-2026-77172App passwords were allowed to bypass password confirmation on sensitive endpoints.
- CVE-2026-87897A SSRF vulnerability found that enables access to internal Chrome Devtools Protocol APIs that can leak the JWT authentication token for…
- CVE-2026-82983The Tables app's share-listing endpoint (GET /apps/tables/share/table/{tableId}) did not verify that the requesting user has manage-level…
- CVE-2026-82986The user in a group can bypass the group restriction set by an administrator on link sharing, creating share links for a table even though…
- CVE-2026-77165File owners were unable to unlock TYPE_TOKEN locks placed by other users, leaving files permanently locked with no recovery path outside of
- CVE-2026-77166The emoji field in the page emoji update endpoint does not properly validate user input.
- CVE-2026-68493After guessing a 62^15 complex unique identifier, a malicious logged in user was able to retrieve a list of memberships for a circle they ar
- CVE-2026-82985The Photos app's filter-based "smart albums" build their file listing using the search configuration (photosSourceFolders) of the user viewi
- CVE-2026-77164Circles' remote-instance signature verification fetches the attacker-supplied keyId URL before trust in the remote instance is established,
- CVE-2026-77170The Deck config API allows authenticated users to set board-scoped configuration keys for arbitrary board IDs without validating whether the
- CVE-2026-82982The Approval app's approve/reject endpoint is meant to require the file's current etag as a freshness check, preventing an approver from app
- CVE-2026-77169A vulnerability in the team folders (formerly group folders) app when used in combination with the workspace app allowed API/REST-only deleg
- CVE-2026-82980Any authenticated user can lock or unlock files they do not own by targeting absolute WebDAV paths of other users.
- CVE-2026-45810Nextcloud: Propfind requests for file comments allowed to load comments for other files
- CVE-2026-45722Nextcloud: Tables app allows limited SQLi in ORDER BY with malicious sort order argument for Table Views
- CVE-2026-45691Nextcloud: Bypass of second factor authentication on DAV endpoints
- CVE-2026-45690Nextcloud: Two-Factor Authentication Bypass via Pending Session Token Replay
- CVE-2026-45545Nextcloud: SQL Injection in Column Type Parameter Allows Arbitrary SQL Execution
- CVE-2026-45544Nextcloud: Information Disclosure of view filter metdata via Broken Sensitive Data Masking in ViewService
- CVE-2026-45543Nextcloud: Deleting a Forms collaborator share leaves uploaded response files accessible through a lingering Files share
- CVE-2026-45286Nextcloud: Calendar app leaked user identifiers via attendee suggestion endpoint
- CVE-2026-45284Nextcloud: Wrong condition in the User OIDC app's LdapService allowed deleted LDAP users to authenticate
- CVE-2026-45285Nextcloud: Hidden Public Link creation when sharing to a Team External Member
- CVE-2026-45283Nextcloud: Files Lock app allows users to lock and unlock files of other users
- CVE-2026-45282Nextcloud: Logged-in user bypasses share password and download restrictions on Text attachments via documentId leads to unauthorized file access