Nextcloud (Server, Tables, Whiteboard, Files Confidential, Collectives, Richdocuments): Mehrere Schwachstellen

Summary

Product

Vulnerabilities 9

• High 7.5
  CVE-2026-77167

  Abusing the federated share endpoint, an attacker can write arbitrary rows into the oc_share_external database table. T…

  Nextcloud Server
  Oct 27, 2026
• Medium 5.3
  CVE-2026-77172

  App passwords were allowed to bypass password confirmation on sensitive endpoints.

  Nextcloud Server
  Oct 27, 2026
• Medium 4.6
  CVE-2026-82986

  The user in a group can bypass the group restriction set by an administrator on link sharing, creating share links for …

  Nextcloud Tables
  Oct 27, 2026
• Medium 4.6
  CVE-2026-87897

  A SSRF vulnerability found that enables access to internal Chrome Devtools Protocol APIs that can leak the JWT authenti…

  Nextcloud whiteboard
  Oct 27, 2026
• Medium 4.3
  CVE-2026-77173

  A user could create a docx or odt file with a # in the filename with confidential information such as a credit card num…

  Nextcloud Files Confidential
  Oct 27, 2026
• Medium 4.3
  CVE-2026-82984

  When a team was configured as "visible to everyone", the web UI correctly blocked non-members from viewing the team ("Y…

  Nextcloud Server
  Oct 27, 2026
• Low 3.5
  CVE-2026-67400

  A missing token type check allowed to retrieve more additional information about the WOPI configuration with a user or …

  Nextcloud Richdocuments
  Oct 27, 2026
• Low 3.5
  CVE-2026-77171

  A public shared collective always allowed recipients of the link to create pages.

  Nextcloud Collectives
  Oct 27, 2026
• Low 3.3
  CVE-2026-82983

  The Tables app's share-listing endpoint (GET /apps/tables/share/table/{tableId}) did not verify that the requesting use…

  Nextcloud Tables
  Oct 27, 2026

Revision history

1. 2026-10-27 #2

   Referenz(en) aufgenommen: EUVD-2026-111131, EUVD-2026-111130, EUVD-2026-111129, EUVD-2026-111128, EUVD-2026-111127, EUVD-2026-111126, EUVD-2026-111134, EUVD-2026-111133, EUVD-2026-111132

2. 2026-10-26 #1

   Initiale Fassung

References

• GitHub Security Advisory GHSA-5572-968j-v7g5 vom 2026-10-26
  https://github.com/nextcloud/security-advisories/security/advisories/GHSA-5572-968j-v7g5
• GitHub Security Advisory GHSA-67c5-gw7r-w35f vom 2026-10-26
  https://github.com/nextcloud/security-advisories/security/advisories/GHSA-67c5-gw7r-w35f
• GitHub Security Advisory GHSA-6m4h-j3wr-v388 vom 2026-10-26
  https://github.com/nextcloud/security-advisories/security/advisories/GHSA-6m4h-j3wr-v388
• GitHub Security Advisory GHSA-c47x-m7w6-c4q8 vom 2026-10-26
  https://github.com/nextcloud/security-advisories/security/advisories/GHSA-c47x-m7w6-c4q8
• GitHub Security Advisory GHSA-g8qc-xvwr-f684 vom 2026-10-26
  https://github.com/nextcloud/security-advisories/security/advisories/GHSA-g8qc-xvwr-f684
• GitHub Security Advisory GHSA-gxg4-gmhx-4qj3 vom 2026-10-26
  https://github.com/nextcloud/security-advisories/security/advisories/GHSA-gxg4-gmhx-4qj3
• GitHub Security Advisory GHSA-p9qq-6vpv-x7wj vom 2026-10-26
  https://github.com/nextcloud/security-advisories/security/advisories/GHSA-p9qq-6vpv-x7wj
• GitHub Security Advisory GHSA-qwm4-h3xh-gmvc vom 2026-10-26
  https://github.com/nextcloud/security-advisories/security/advisories/GHSA-qwm4-h3xh-gmvc
• GitHub Security Advisory GHSA-w7pp-8m7c-555c vom 2026-10-26
  https://github.com/nextcloud/security-advisories/security/advisories/GHSA-w7pp-8m7c-555c
• GitHub Security Advisory GHSA-x4hv-m8g6-5cj4 vom 2026-10-26
  https://github.com/nextcloud/security-advisories/security/advisories/GHSA-x4hv-m8g6-5cj4