CVE-2026-45157

Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, when a malicious user has access to a file share of a user, they could use this share token to also access the chunking upload directly and see temporary part files during on going uploads. It is recommended that the Nextcloud Server is upgraded to 32.0.9 or 33.0.3. It is recommended that the Nextcloud Enterprise Server is upgraded to 26.0.13.26, 27.1.11.25, 28.0.14.17, 29.0.16.16, 30.0.17.9, 31.0.14.5, 32.0.9 or 33.0.3

CVSS v3 6.3 MEDIUM

6.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.1 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-45pj-p7x7-4mhc
https://github.com/nextcloud/server/pull/59780
https://hackerone.com/reports/3483708

Configurations

No configuration.

History

22 Jul 2026, 07:10

Type	Values Removed	Values Added
Summary		(es) Nextcloud es una plataforma de colaboración de contenido de código abierto. En Nextcloud Servidor, desde las versiones 32.0.0 hasta antes de la 32.0.9, y de la 33.0.0 hasta antes de la 33.0.3, cuando un usuario malicioso tiene acceso a un recurso compartido de archivos de un usuario, podría usar este token de recurso compartido para también acceder directamente a la carga por fragmentos y ver archivos de parte temporales durante las cargas en curso. Se recomienda que el Nextcloud Servidor se actualice a la 32.0.9 o a la 33.0.3. Se recomienda que el Nextcloud Enterprise Servidor se actualice a la 26.0.13.26, 27.1.11.25, 28.0.14.17, 29.0.16.16, 30.0.17.9, 31.0.14.5, 32.0.9 o a la 33.0.3.

01 Jun 2026, 17:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-06-01 17:17

Updated : 2026-07-22 07:10

NVD link : CVE-2026-45157

Mitre link : CVE-2026-45157

CVE.ORG link : CVE-2026-45157

JSON object : View

Products Affected

No product.

CWE

CWE-284

Improper Access Control

{"id": "CVE-2026-45157", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-45157", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-01T18:49:11.015107Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 4.2, "exploitabilityScore": 2.1}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "nextcloud", "product": "security-advisories", "versions": [{"status": "affected", "version": ">= 32.0.0, < 32.0.9"}, {"status": "affected", "version": ">= 33.0.0, < 33.0.3"}]}]}], "published": "2026-06-01T17:17:09.420", "references": [{"url": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-45pj-p7x7-4mhc", "source": "security-advisories@github.com"}, {"url": "https://github.com/nextcloud/server/pull/59780", "source": "security-advisories@github.com"}, {"url": "https://hackerone.com/reports/3483708", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-284"}]}], "descriptions": [{"lang": "en", "value": "Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, when a malicious user has access to a file share of a user, they could use this share token to also access the chunking upload directly and see temporary part files during on going uploads. It is recommended that the Nextcloud Server is upgraded to 32.0.9 or 33.0.3. It is recommended that the Nextcloud Enterprise Server is upgraded to 26.0.13.26, 27.1.11.25, 28.0.14.17, 29.0.16.16, 30.0.17.9, 31.0.14.5, 32.0.9 or 33.0.3"}, {"lang": "es", "value": "Nextcloud es una plataforma de colaboraci\u00f3n de contenido de c\u00f3digo abierto. En Nextcloud Servidor, desde las versiones 32.0.0 hasta antes de la 32.0.9, y de la 33.0.0 hasta antes de la 33.0.3, cuando un usuario malicioso tiene acceso a un recurso compartido de archivos de un usuario, podr\u00eda usar este token de recurso compartido para tambi\u00e9n acceder directamente a la carga por fragmentos y ver archivos de parte temporales durante las cargas en curso. Se recomienda que el Nextcloud Servidor se actualice a la 32.0.9 o a la 33.0.3. Se recomienda que el Nextcloud Enterprise Servidor se actualice a la 26.0.13.26, 27.1.11.25, 28.0.14.17, 29.0.16.16, 30.0.17.9, 31.0.14.5, 32.0.9 o a la 33.0.3."}], "lastModified": "2026-07-22T07:10:00.107", "sourceIdentifier": "security-advisories@github.com"}