CVE-2026-45283
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
Nextcloud Server from versions 32.0.0 to before 32.0.2, and 33.0.0 to before 33.0.1, the files_lock app did not properly validate the ownership of files when processing DAV lock and unlock requests. An authenticated user could lock or unlock files belonging to other users by targeting their absolute WebDAV paths. Additionally, lock tokens were disclosed to unauthorized callers in error responses, allowing attackers to remove token-based locks placed by other users' client applications. It is recommended that the Nextcloud Server is upgraded to 32.0.2 or 33.0.1. It is recommended that the Nextcloud Enterprise Server is upgraded to 31.0.14.4 or 32.0.2 or 33.0.1.
Risk Assessment
The risk is that an authenticated attacker can lock files of other users, preventing access, or unlock files, potentially leading to edit conflicts and data integrity issues.
Recommendation
It is recommended to immediately upgrade Nextcloud Server to version 32.0.2 or 33.0.1, and Nextcloud Enterprise Server to version 31.0.14.4, 32.0.2, or 33.0.1.
Other vulnerabilities in Nextcloud Server
See all- CVE-2026-45810Medium
Nextcloud Server before versions 31.0.12 and 32.0.3 has a missing check of a relation, allowing authenticated users with access to any file comment to read the content of all comments.
- CVE-2026-45691Medium
In Nextcloud Server before versions 32.0.9 and 33.0.3, a pre-2FA session cookie can be reused as a Bearer token to authenticate against DAV endpoints, bypassing mandatory two-factor authentication.
- CVE-2026-45690Medium
In Nextcloud Server before versions 32.0.9 and 33.0.3, an attacker with knowledge of a user's password can bypass two-factor authentication by extracting a temporary session token and replaying it via HTTP Basic Authentication.
- CVE-2026-45285Medium
In Nextcloud Server before versions 32.0.9 and 33.0.3, sharing a folder or file with a team containing an external member automatically creates a public link that is invisible to the owner and cannot be revoked, granting full permissions.
- CVE-2026-45282Medium
In Nextcloud Server before versions 32.0.9 and 33.0.3, an authenticated attacker can access attachments of link shares when knowing the share token, bypassing password protection or download restrictions.
- CVE-2026-45281High
An improper authorization vulnerability in the calendar backend of Nextcloud Server (versions 32.0.0-32.0.8 and 33.0.0-33.0.2) allows an authenticated attacker, knowing another user's principal URL, to gain full read and write access to that user's calendar.
- CVE-2026-45279Medium
In Nextcloud Server from versions 31.0.0 to before 31.0.14, and 32.0.0 to before 32.0.4, if {lang} is used in the template directory config value, non-admin users can in some cases copy arbitrary files (depending on unix permissions) into their own Nextcloud directory via a path traversal.
- CVE-2026-45157Medium
Nextcloud Server contains a vulnerability that allows a malicious user with access to a shared file to use the share token to directly access chunking uploads and view temporary part files during ongoing uploads. The issue affects versions from 32.0.0 to 32.0.8 and from 33.0.0 to 33.0.2.
- CVE-2023-39963High
Nextcloud Server has a vulnerability that allows an attacker to create app passwords for a victim after stealing a session from a logged-in user. The issue affects versions from 20.0.0 to 20.0.14.15, 21.0.9.13, 22.2.10.14, 23.0.12.8, 24.0.12.5, 25.0.9, 26.0.4, and 27.0.1.
- CVE-2023-39962High
Nextcloud Server, an open source cloud platform, has a vulnerability that allows a malicious user to delete any personal or global external storage, making it inaccessible to other users. The issue affects versions from 19.0.0 to 19.0.13.10, 20.0.14.15, 21.0.9.13, 22.2.10.14, 23.0.12.8, 24.0.12.5, 25.0.9, 26.0.4, and 27.0.1.
Original NVD description (English source)
Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.2, and 33.0.0 to before 33.0.1, the files_lock app did not properly validate the ownership of files when processing DAV lock and unlock requests. An authenticated user could lock or unlock files belonging to other users by targeting their absolute WebDAV paths. Additionally, lock tokens were disclosed to unauthorized callers in error responses, allowing attackers to remove token-based locks placed by other users' client applications. It is recommended that the Nextcloud Server is upgraded to 32.0.2 or 33.0.1. It is recommended that the Nextcloud Enterprise Server is upgraded to 31.0.14.4 or 32.0.2 or 33.0.1