CVE-2026-45543
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
Nextcloud from version 4.3.0 to before 5.2.7 allows a removed collaborator to retain unauthorized read access to uploaded respondent files for the affected form. The scope is limited to forms where that user previously had results access.
Risk Assessment
A removed user can still access confidential respondent data, violating confidentiality and access control policies.
Recommendation
Update Nextcloud to version 5.2.7 or later, which fixes this vulnerability.
Other vulnerabilities in Nextcloud
See all- CVE-2026-45545High
Vulnerability in the Tables app in Nextcloud (versions 0.7.0 to before 0.7.7, 0.8.0 to before 0.8.10, 0.9.0 to before 0.9.8, 1.0.0 to before 1.0.4). An authenticated attacker with access to the Tables app can execute arbitrary SQL queries up to 20 bytes long via stored injection. The length limitation can be bypassed.
- CVE-2026-45286Medium
Nextcloud is an open source content collaboration platform. From versions 5.5.13 to before 5.5.17, and 6.2.0 to before 6.2.3, an authenticated user can enumerate users on the same Nextcloud instance by using the Calendar app's endpoint for suggesting attendees.
- CVE-2026-45284Medium
In Nextcloud from version 1.3.6 to before 8.4.0, an improper check allowed users provided by LDAP to still authenticate via OIDC after being deleted from LDAP.
- CVE-2026-45278Low
Nextcloud is an open source content collaboration platform. From version 6.1.0 to before version 8.2.2, an attacker can craft links that would redirect users to another website, when the victim uses the attackers link to log in via user OIDC. This issue has been patched in version 8.2.2.
- CVE-2026-45277Low
In Nextcloud prior to version 2.7.2, authenticated users can check if arbitrary files are associated with specific approval workflows where they can request approval. This issue has been patched in version 2.7.2.
- CVE-2026-45267Medium
In Nextcloud prior to version 5.2.6, a missing permissions check allowed users to request reading form submissions of other users. This issue has been patched in version 5.2.6.
- CVE-2026-45266Low
In Nextcloud prior to versions 21.1.10, 22.0.11, and 23.0.3, a low-privileged user can force other users' microphones to be muted in calls when no High-performance Backend is installed.
- CVE-2026-45264Medium
In Nextcloud, an open source content collaboration platform, versions 17.0.0 to before 17.0.15, 18.0.0 to before 18.1.12, 19.0.0 to before 19.1.16, 20.0.0 to before 20.1.11, and 21.0.0 to before 21.0.4, a user with READ and CREATE permission but no UPDATE permission can rename files in a team folder. This has been patched in versions 17.0.15, 18.1.12, 19.1.16, 20.1.11, and 21.0.4.
- CVE-2026-45159Low
In Nextcloud from versions 1.15.0 to before 1.15.4, 1.16.0 to before 1.16.3, 1.17.0 to before 1.17.1, and 1.18.0 to before 1.18.1, a malicious user with access to an end-to-end encrypted files drop link could drop files into other encrypted folders of the share owner. Reading and modifying other files was not possible.
- CVE-2026-45156High
Nextcloud (an open source content collaboration platform) versions 0.3.0 to before 3.1.0, 5.0.0 to before 5.1.0, and 6.0.0 to before 6.4.0 have a missing signature verification in User OIDC, allowing a malicious ID4me authority to impersonate any user.
Original NVD description (English source)
Nextcloud is an open source content collaboration platform. From version 4.3.0 to before version 5.2.7, a removed collaborator retains unauthorized read access to uploaded respondent files for the affected form. The scope is limited to uploaded files for forms where that user previously had results access. This issue has been patched in version 5.2.7.