CVE-2026-45264

Nextcloud is an open source content collaboration platform. From versions 17.0.0 to before 17.0.15, 18.0.0 to before 18.1.12, 19.0.0 to before 19.1.16, 20.0.0 to before 20.1.11, and 21.0.0 to before 21.0.4, a user with READ and CREATE permission, but no UPDATE permission for a team folder can rename files in the team folder. This issue has been patched in versions 17.0.15, 18.1.12, 19.1.16, 20.1.11, and 21.0.4.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/nextcloud/groupfolders/pull/4361
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-wx2x-822r-rvmf
https://hackerone.com/reports/3540673

Configurations

No configuration.

History

22 Jul 2026, 07:10

Type	Values Removed	Values Added
Summary		(es) Nextcloud es una plataforma de colaboración de contenido de código abierto. Desde las versiones 17.0.0 hasta antes de la 17.0.15, de la 18.0.0 hasta antes de la 18.1.12, de la 19.0.0 hasta antes de la 19.1.16, de la 20.0.0 hasta antes de la 20.1.11, y de la 21.0.0 hasta antes de la 21.0.4, un usuario con permiso de LECTURA y CREACIÓN, pero sin permiso de ACTUALIZACIÓN para una carpeta de equipo, puede renombrar archivos en dicha carpeta de equipo. Este problema ha sido parcheado en las versiones 17.0.15, 18.1.12, 19.1.16, 20.1.11 y 21.0.4.

01 Jun 2026, 17:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-06-01 17:17

Updated : 2026-07-22 07:10

NVD link : CVE-2026-45264

Mitre link : CVE-2026-45264

CVE.ORG link : CVE-2026-45264

JSON object : View

Products Affected

No product.

CWE

CWE-284

Improper Access Control

{"id": "CVE-2026-45264", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-45264", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-01T17:47:35.907468Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "nextcloud", "product": "security-advisories", "versions": [{"status": "affected", "version": ">= 17.0.0, < 17.0.15"}, {"status": "affected", "version": ">= 18.0.0, < 18.1.12"}, {"status": "affected", "version": ">= 19.0.0, < 19.1.16"}, {"status": "affected", "version": ">= 20.0.0, < 20.1.11"}, {"status": "affected", "version": ">= 21.0.0, < 21.0.4"}]}]}], "published": "2026-06-01T17:17:09.690", "references": [{"url": "https://github.com/nextcloud/groupfolders/pull/4361", "source": "security-advisories@github.com"}, {"url": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-wx2x-822r-rvmf", "source": "security-advisories@github.com"}, {"url": "https://hackerone.com/reports/3540673", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-284"}]}], "descriptions": [{"lang": "en", "value": "Nextcloud is an open source content collaboration platform. From versions 17.0.0 to before 17.0.15, 18.0.0 to before 18.1.12, 19.0.0 to before 19.1.16, 20.0.0 to before 20.1.11, and 21.0.0 to before 21.0.4, a user with READ and CREATE permission, but no UPDATE permission for a team folder can rename files in the team folder. This issue has been patched in versions 17.0.15, 18.1.12, 19.1.16, 20.1.11, and 21.0.4."}, {"lang": "es", "value": "Nextcloud es una plataforma de colaboraci\u00f3n de contenido de c\u00f3digo abierto. Desde las versiones 17.0.0 hasta antes de la 17.0.15, de la 18.0.0 hasta antes de la 18.1.12, de la 19.0.0 hasta antes de la 19.1.16, de la 20.0.0 hasta antes de la 20.1.11, y de la 21.0.0 hasta antes de la 21.0.4, un usuario con permiso de LECTURA y CREACI\u00d3N, pero sin permiso de ACTUALIZACI\u00d3N para una carpeta de equipo, puede renombrar archivos en dicha carpeta de equipo. Este problema ha sido parcheado en las versiones 17.0.15, 18.1.12, 19.1.16, 20.1.11 y 21.0.4."}], "lastModified": "2026-07-22T07:10:00.107", "sourceIdentifier": "security-advisories@github.com"}