CVE-2026-45154
LowCVSS 2.6Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
Nextcloud, an open source content collaboration platform, from version 2.6.0 to before version 4.3.0, allowed guests with view-only access to a collective to access deleted pages from the trashbin if a previous collective page was deleted. This issue has been patched in version 4.3.0.
Risk Assessment
The organization is at risk of unauthorized access to deleted data by guests, potentially leading to leakage of confidential information.
Recommendation
It is recommended to update Nextcloud to version 4.3.0 or later to mitigate this vulnerability.
Original NVD description (English source)
Nextcloud is an open source content collaboration platform. From version 2.6.0 to before version 4.3.0, when a previous collective pages was deleted and the collective was shared view-only, guests with access to the collective were able to access the deleted pages directly from the trashbin. This issue has been patched in version 4.3.0.