CVE-2026-45545
HighCVSS 8.2Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
Vulnerability in the Tables app in Nextcloud (versions 0.7.0 to before 0.7.7, 0.8.0 to before 0.8.10, 0.9.0 to before 0.9.8, 1.0.0 to before 1.0.4). An authenticated attacker with access to the Tables app can execute arbitrary SQL queries up to 20 bytes long via stored injection. The length limitation can be bypassed.
Risk Assessment
An attacker could extract information from the database or modify data, potentially leading to data confidentiality and integrity breaches.
Recommendation
Update Nextcloud to version 0.7.7, 0.8.10, 0.9.8, 1.0.4, or 2.0.0 (depending on the branch used).
Other vulnerabilities in Nextcloud
See all- CVE-2026-45543Medium
Nextcloud from version 4.3.0 to before 5.2.7 allows a removed collaborator to retain unauthorized read access to uploaded respondent files for the affected form. The scope is limited to forms where that user previously had results access.
- CVE-2026-45286Medium
Nextcloud is an open source content collaboration platform. From versions 5.5.13 to before 5.5.17, and 6.2.0 to before 6.2.3, an authenticated user can enumerate users on the same Nextcloud instance by using the Calendar app's endpoint for suggesting attendees.
- CVE-2026-45284Medium
In Nextcloud from version 1.3.6 to before 8.4.0, an improper check allowed users provided by LDAP to still authenticate via OIDC after being deleted from LDAP.
- CVE-2026-45278Low
Nextcloud is an open source content collaboration platform. From version 6.1.0 to before version 8.2.2, an attacker can craft links that would redirect users to another website, when the victim uses the attackers link to log in via user OIDC. This issue has been patched in version 8.2.2.
- CVE-2026-45277Low
In Nextcloud prior to version 2.7.2, authenticated users can check if arbitrary files are associated with specific approval workflows where they can request approval. This issue has been patched in version 2.7.2.
- CVE-2026-45267Medium
In Nextcloud prior to version 5.2.6, a missing permissions check allowed users to request reading form submissions of other users. This issue has been patched in version 5.2.6.
- CVE-2026-45266Low
In Nextcloud prior to versions 21.1.10, 22.0.11, and 23.0.3, a low-privileged user can force other users' microphones to be muted in calls when no High-performance Backend is installed.
- CVE-2026-45264Medium
In Nextcloud, an open source content collaboration platform, versions 17.0.0 to before 17.0.15, 18.0.0 to before 18.1.12, 19.0.0 to before 19.1.16, 20.0.0 to before 20.1.11, and 21.0.0 to before 21.0.4, a user with READ and CREATE permission but no UPDATE permission can rename files in a team folder. This has been patched in versions 17.0.15, 18.1.12, 19.1.16, 20.1.11, and 21.0.4.
- CVE-2026-45159Low
In Nextcloud from versions 1.15.0 to before 1.15.4, 1.16.0 to before 1.16.3, 1.17.0 to before 1.17.1, and 1.18.0 to before 1.18.1, a malicious user with access to an end-to-end encrypted files drop link could drop files into other encrypted folders of the share owner. Reading and modifying other files was not possible.
- CVE-2026-45156High
Nextcloud (an open source content collaboration platform) versions 0.3.0 to before 3.1.0, 5.0.0 to before 5.1.0, and 6.0.0 to before 6.4.0 have a missing signature verification in User OIDC, allowing a malicious ID4me authority to impersonate any user.
Original NVD description (English source)
Nextcloud is an open source content collaboration platform. From versions 0.7.0 to before 0.7.7, 0.8.0 to before 0.8.10, 0.9.0 to before 0.9.8, and 1.0.0 to before 1.0.4, an authenticated attacker with access to the Tables app may be able to execute arbitrary up to 20 bytes long SQL queries, through a stored injection. With carefully crafted input it is possible to break out of the length limitation. The attacker could use this to extract information from the database, or modify data. This issue has been patched in versions 0.7.7, 0.8.10, 0.9.8, 1.0.4, and 2.0.0.