CVE-2026-45545

Nextcloud is an open source content collaboration platform. From versions 0.7.0 to before 0.7.7, 0.8.0 to before 0.8.10, 0.9.0 to before 0.9.8, and 1.0.0 to before 1.0.4, an authenticated attacker with access to the Tables app may be able to execute arbitrary up to 20 bytes long SQL queries, through a stored injection. With carefully crafted input it is possible to break out of the length limitation. The attacker could use this to extract information from the database, or modify data. This issue has been patched in versions 0.7.7, 0.8.10, 0.9.8, 1.0.4, and 2.0.0.

CVSS v3 8.2 HIGH

8.2^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.8

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-x43f-gmgh-vvjj	Mitigation Vendor Advisory
https://github.com/nextcloud/tables/pull/2309	Issue Tracking Patch
https://hackerone.com/reports/3462991	Permissions Required

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:nextcloud:tables::::::nextcloud::*
	cpe:2.3:a:nextcloud:tables::::::nextcloud::*
	cpe:2.3:a:nextcloud:tables::::::nextcloud::*
	cpe:2.3:a:nextcloud:tables::::::nextcloud::*

History

04 Jun 2026, 16:50

Type	Values Removed	Values Added
References	~~() https://github.com/nextcloud/security-advisories/security/advisories/GHSA-x43f-gmgh-vvjj -~~	() https://github.com/nextcloud/security-advisories/security/advisories/GHSA-x43f-gmgh-vvjj - Mitigation, Vendor Advisory
References	~~() https://github.com/nextcloud/tables/pull/2309 -~~	() https://github.com/nextcloud/tables/pull/2309 - Issue Tracking, Patch
References	~~() https://hackerone.com/reports/3462991 -~~	() https://hackerone.com/reports/3462991 - Permissions Required
First Time		Nextcloud Nextcloud tables
CPE		cpe:2.3:a:nextcloud:tables::::::nextcloud::*

01 Jun 2026, 19:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-06-01 19:16

Updated : 2026-06-04 16:50

NVD link : CVE-2026-45545

Mitre link : CVE-2026-45545

CVE.ORG link : CVE-2026-45545

JSON object : View

Products Affected

nextcloud

tables

CWE

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

{"id": "CVE-2026-45545", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.8, "exploitabilityScore": 1.8}]}, "published": "2026-06-01T19:16:52.020", "references": [{"url": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-x43f-gmgh-vvjj", "tags": ["Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/nextcloud/tables/pull/2309", "tags": ["Issue Tracking", "Patch"], "source": "security-advisories@github.com"}, {"url": "https://hackerone.com/reports/3462991", "tags": ["Permissions Required"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-89"}]}], "descriptions": [{"lang": "en", "value": "Nextcloud is an open source content collaboration platform. From versions 0.7.0 to before 0.7.7, 0.8.0 to before 0.8.10, 0.9.0 to before 0.9.8, and 1.0.0 to before 1.0.4, an authenticated attacker with access to the Tables app may be able to execute arbitrary up to 20 bytes long SQL queries, through a stored injection. With carefully crafted input it is possible to break out of the length limitation. The attacker could use this to extract information from the database, or modify data. This issue has been patched in versions 0.7.7, 0.8.10, 0.9.8, 1.0.4, and 2.0.0."}], "lastModified": "2026-06-04T16:50:00.957", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:nextcloud:tables:*:*:*:*:*:nextcloud:*:*", "vulnerable": true, "matchCriteriaId": "27CC977D-61ED-4C97-90DB-6CB5F4D27CA4", "versionEndExcluding": "0.7.7", "versionStartIncluding": "0.7.0"}, {"criteria": "cpe:2.3:a:nextcloud:tables:*:*:*:*:*:nextcloud:*:*", "vulnerable": true, "matchCriteriaId": "AEACC561-5610-4940-A246-5E2A51BD35C1", "versionEndExcluding": "0.8.10", "versionStartIncluding": "0.8.0"}, {"criteria": "cpe:2.3:a:nextcloud:tables:*:*:*:*:*:nextcloud:*:*", "vulnerable": true, "matchCriteriaId": "36CBF1A6-A92D-4F31-8DE3-245D5DF3B3DD", "versionEndExcluding": "0.9.8", "versionStartIncluding": "0.9.0"}, {"criteria": "cpe:2.3:a:nextcloud:tables:*:*:*:*:*:nextcloud:*:*", "vulnerable": true, "matchCriteriaId": "93525B1A-60DB-4A65-BC05-96E1D3A4DA65", "versionEndExcluding": "1.0.4", "versionStartIncluding": "1.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}