Nextcloud vulnerabilities | LiveThreat CVE Feed

CVE	Product	CVSS	EPSS	Published	Summary
CVE-2026-82984 New	SE Server Nextcloud	4.3	0%	Oct 27	When a team was configured as "visible to everyone", the web UI correctly blocked non-members from viewing the team ("You are not a member of ..."), but the resources API endpoint…
CVE-2026-77167 New	SE server Nextcloud	7.5	0%	Oct 27	Abusing the federated share endpoint, an attacker can write arbitrary rows into the oc_share_external database table
CVE-2026-77173 New	FC Files Confidential Nextcloud	4.3	0%	Oct 27	A user could create a docx or odt file with a # in the filename with confidential information such as a credit card number and have it not be marked as confidential
CVE-2026-67400 New	RI Richdocuments Nextcloud	3.5	0%	Oct 27	A missing token type check allowed to retrieve more additional information about the WOPI configuration with a user or guest token
CVE-2026-77171 New	CO Collectives Nextcloud	3.5	0%	Oct 27	A public shared collective always allowed recipients of the link to create pages
CVE-2026-77172 New	SE Server Nextcloud	5.3	0%	Oct 27	App passwords were allowed to bypass password confirmation on sensitive endpoints
CVE-2026-87897 New	WH whiteboard Nextcloud	4.6	0%	Oct 27	A SSRF vulnerability found that enables access to internal Chrome Devtools Protocol APIs that can leak the JWT authentication token for another user
CVE-2026-82983 New	TA Tables Nextcloud	3.3	0%	Oct 27	The Tables app's share-listing endpoint (GET /apps/tables/share/table/{tableId}) did not verify that the requesting user has manage-level permission on the table before returning…
CVE-2026-82986 New	TA Tables Nextcloud	4.6	0%	Oct 27	The user in a group can bypass the group restriction set by an administrator on link sharing, creating share links for a table even though they shouldn't have that permission
CVE-2026-77165	SE Server Nextcloud	6.5	0%	Sep 21	File owners were unable to unlock TYPE_TOKEN locks placed by other users, leaving files permanently locked with no recovery path outside of the database
CVE-2026-77166	CO Collectives Nextcloud	2.4	0%	Sep 21	The emoji field in the page emoji update endpoint does not properly validate user input
CVE-2026-68493	SE Server Nextcloud	3.1	0%	Sep 18	After guessing a 62^15 complex unique identifier, a malicious logged in user was able to retrieve a list of memberships for a circle they are not a member of
CVE-2026-77164	SE Server Nextcloud	6.2	0%	Sep 18	Circles' remote-instance signature verification fetches the attacker-supplied keyId URL before trust in the remote instance is established, and explicitly allows local/private…
CVE-2026-82985	SE Server Nextcloud	6.5	0%	Sep 18	The Photos app's filter-based "smart albums" build their file listing using the search configuration (photosSourceFolders) of the user viewing the album, rather than the album…
CVE-2026-77170	DE Deck Nextcloud	4.3	0%	Sep 18	The Deck config API allows authenticated users to set board-scoped configuration keys for arbitrary board IDs without validating whether the user owns or has permission to manage…
CVE-2026-82982	AP Approval Nextcloud	4.3	0%	Sep 18	The Approval app's approve/reject endpoint is meant to require the file's current etag as a freshness check, preventing an approver from approving or rejecting a file whose…
CVE-2026-77169	TF Team Folders Nextcloud	6.5	0%	Sep 18	A vulnerability in the team folders (formerly group folders) app when used in combination with the workspace app allowed API/REST-only delegated administrators to bypass…
CVE-2026-82980	FL Files Lock Nextcloud	6.3	0%	Sep 18	Any authenticated user can lock or unlock files they do not own by targeting absolute WebDAV paths of other users
CVE-2026-45810	SE security-advisories nextcloud	6.8	0%	Jun 1	Nextcloud: Propfind requests for file comments allowed to load comments for other files
CVE-2026-45722	SE security-advisories nextcloud	7.1	0%	Jun 1	Nextcloud: Tables app allows limited SQLi in ORDER BY with malicious sort order argument for Table Views
CVE-2026-45691	SE security-advisories nextcloud	5.9	0%	Jun 1	Nextcloud: Bypass of second factor authentication on DAV endpoints
CVE-2026-45690	SE security-advisories nextcloud	5.9	0%	Jun 1	Nextcloud: Two-Factor Authentication Bypass via Pending Session Token Replay
CVE-2026-45545	SE security-advisories nextcloud	8.2	0%	Jun 1	Nextcloud: SQL Injection in Column Type Parameter Allows Arbitrary SQL Execution
CVE-2026-45544	SE security-advisories nextcloud	4.3	0%	Jun 1	Nextcloud: Information Disclosure of view filter metdata via Broken Sensitive Data Masking in ViewService
CVE-2026-45543	SE security-advisories nextcloud	5.3	0%	Jun 1	Nextcloud: Deleting a Forms collaborator share leaves uploaded response files accessible through a lingering Files share
CVE-2026-45286	SE security-advisories nextcloud	4.3	0%	Jun 1	Nextcloud: Calendar app leaked user identifiers via attendee suggestion endpoint
CVE-2026-45284	SE security-advisories nextcloud	8.8	0%	Jun 1	Nextcloud: Wrong condition in the User OIDC app's LdapService allowed deleted LDAP users to authenticate
CVE-2026-45285	SE security-advisories nextcloud	6.4	0%	Jun 1	Nextcloud: Hidden Public Link creation when sharing to a Team External Member
CVE-2026-45283	SE security-advisories nextcloud	4.3	0%	Jun 1	Nextcloud: Files Lock app allows users to lock and unlock files of other users
CVE-2026-45282	SE security-advisories nextcloud	6.5	0%	Jun 1	Nextcloud: Logged-in user bypasses share password and download restrictions on Text attachments via documentId leads to unauthorized file access
CVE-2026-45281	SE security-advisories nextcloud	8.1	0%	Jun 1	Nextcloud: Cross-Account Calendar Takeover via Unauthorized Group-Member-Set Update
CVE-2026-45279	SE security-advisories nextcloud	6.5	0%	Jun 1	Nextcloud: Limited path traversal via template API if using `{lang}` in config
CVE-2026-45278	SE security-advisories nextcloud	6.1	0%	Jun 1	Nextcloud: Open Redirect in user_oidc login flow via protocol-relative URL bypass
CVE-2026-45277	SE security-advisories nextcloud	3.3	0%	Jun 1	Nextcloud: Information disclosure in Nextcloud Approval app via fileId parameter reveals workflow associations
CVE-2026-45275	SE security-advisories nextcloud	6.5	0%	Jun 1	Nextcloud: Authorization bypass in approval feature allows unauthorized file sharing with approvers
CVE-2026-45267	SE security-advisories nextcloud	6.5	0%	Jun 1	Nextcloud: Missing permission check for from submissions
CVE-2026-45266	SE security-advisories nextcloud	3.5	0%	Jun 1	Nextcloud: Unauthorized force-mute from missing permission check when using internal signaling
CVE-2026-45159	SE security-advisories nextcloud	3.5	0%	Jun 1	Nextcloud: Files drop share links for end-to-end encrypted folders allowed to drop files into other folders of the share owner
CVE-2026-45157	SE security-advisories nextcloud	6.3	0%	Jun 1	Nextcloud: Valid share tokens allow to access tempory upload files of share owner
CVE-2026-45156	SE security-advisories nextcloud	8.1	0%	Jun 1	Nextcloud: Authentication Bypass in ID4me handling via Missing JWT Signature Verification in User OIDC
CVE-2026-45155	SE security-advisories nextcloud	2.6	0%	Jun 1	Nextcloud: Private circle can be added to another circle via API
CVE-2026-45154	SE security-advisories nextcloud	2.6	0%	Jun 1	Nextcloud: Improper Access Control in Collectives
CVE-2026-45153	SE security-advisories nextcloud	4.6	0%	Jun 1	Nextcloud: PIN bypass in PassCodeActivity via back button
CVE-2026-45264	SE security-advisories nextcloud	4.3	0%	Jun 1	Nextcloud: ACL Rename Permission Bypass in Team Folders Allows Unauthorized File Renames
CVE-2026-44515	NE news nextcloud	2.3	0%	May 14	Nextcloud News: Authenticated blind SSRF via feed URL
CVE-2026-22683	FL Flow Nextcloud	8.8	3%	Apr 7	Windmill < 1.615.0 Operator Role Missing Authorization Checks RCE
CVE-2025-64011	NS Nextcloud Server Nextcloud	4.3	0%	Dec 12	Nextcloud Server 30.0.0 is vulnerable to an Insecure Direct Object Reference (IDOR) in the /core/preview endpoint
CVE-2025-66558	SE security-advisories nextcloud	4.3	0%	Dec 5	Nextcloud Twofactor WebAuthn app was updated based on public key
CVE-2025-66556	SE security-advisories nextcloud	4.3	0%	Dec 5	Nextcloud talk allows participants to blindly delete poll drafts of other users by ID
CVE-2025-66554	SE security-advisories nextcloud	5.4	0%	Dec 5	Nextcloud Contacts vulnerable to Stored XSS in contacts app via organisation and title field
CVE-2025-66549	SE security-advisories nextcloud	2.7	0%	Dec 5	Nextcloud Desktop discloses information when attempting to lock a file inside a end-to-end encrypted directory
CVE-2025-66545	SE security-advisories nextcloud	4.3	0%	Dec 5	Nextcloud Groupfolders users with read-only permissions for team folder can restore deleted files from trash bin
CVE-2025-66515	SE security-advisories nextcloud	2.7	0%	Dec 5	Nextcloud Approval app allows users to request approval for other users file
CVE-2025-66514	SE security-advisories nextcloud	5.4	0%	Dec 5	Nextcloud Mail stored HTML injection in subject text
CVE-2025-66557	SE security-advisories nextcloud	4.3	0%	Dec 5	Nextcloud Deck app allowed user with "Can share" permission to modify permissions of other non-owners
CVE-2025-66548	SE security-advisories nextcloud	5.5	0%	Dec 5	Nextcloud Deck app allows to spoof file extensions by using RTLO characters
CVE-2025-66553	SE security-advisories nextcloud	4.3	0%	Dec 5	Nextcloud Tables app allowed users to view columns metadata information of any table
CVE-2025-66551	SE security-advisories nextcloud	4.3	0%	Dec 5	Nextcloud Tables is missing an ownership check which allows moving columns into tables of other users
CVE-2025-66513	SE security-advisories nextcloud	5.3	0%	Dec 5	Nextcloud Tables app share information not limited to relevant users
CVE-2025-66550	SE security-advisories nextcloud	5.7	0%	Dec 5	Nextcloud Calendar attachments of local files are offered to downloaded