Skip to content
OpenAdvisories
High WID-SEC-2026-1517 4 CVEs

Nextcloud: Mehrere Schwachstellen

Published May 12, 2026 · Updated Jun 1, 2026 · Revision 2 · de-DE

Vendor: Nextcloud Product: Nextcloud Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Nextcloud ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um Informationen offenzulegen, und um einen SQL-Injection Angriff durchzuführen.

Product

Nextcloud ist eine "on-premise" Plattform für Dateifreigabe und Zusammenarbeit.

Vulnerabilities 4

  • High 8.2
    CVE-2026-45545

    Nextcloud: SQL Injection in Column Type Parameter Allows Arbitrary SQL Execution

    Nextcloud is an open source content collaboration platform. From versions 0.7.0 to before 0.7.7, 0.8.0 to before 0.8.10, 0.9.0 to before 0.9.8, and 1.0.0 to before 1.0.4, an authenticated attacker with access to the Tables app may be able to execute arbitrary…

    Nextcloud security-advisories
  • Medium 5.9
    CVE-2026-45691

    Nextcloud: Bypass of second factor authentication on DAV endpoints

    Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, a pre-2FA session cookie (created after successful password authentication but before TOTP completion) could be…

    Nextcloud security-advisories
  • Medium 5.3
    CVE-2026-45543

    Nextcloud: Deleting a Forms collaborator share leaves uploaded response files accessible through a lingering Files share

    Nextcloud is an open source content collaboration platform. From version 4.3.0 to before version 5.2.7, a removed collaborator retains unauthorized read access to uploaded respondent files for the affected form. The scope is limited to uploaded files for form…

    Nextcloud security-advisories
  • Medium 4.3
    CVE-2026-45544

    Nextcloud: Information Disclosure of view filter metdata via Broken Sensitive Data Masking in ViewService

    Nextcloud is an open source content collaboration platform. From version 0.8.0 to before version 1.0.4, the view filter criteria is exposed to users with read-only permissions in Nextcloud Tables. This issue has been patched in versions 1.0.4 and 2.0.0.

    Nextcloud security-advisories

Revision history

  1. #2

    Referenz(en) aufgenommen: EUVD-2026-33718, EUVD-2026-33715, EUVD-2026-33714, EUVD-2026-33713

  2. #1

    Initiale Fassung

References