CVE-2026-45810: Nextcloud: Propfind requests for file comments allowed to load comments for other files

Medium severity · published Jun 1, 2026

CVE-2026-45810

Nextcloud: Propfind requests for file comments allowed to load comments for other files

6.8

CVSS

0.3%

EPSS

On KEV

Description

Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 31.0.0 to before 31.0.12, and 32.0.0 to before 32.0.3, a missing check of a relation allowed authenticated users with access to any file comment, to read the content of all comments. It is recommended that the Nextcloud Server is upgraded to 31.0.12 or 32.0.3. It is recommended that the Nextcloud Enterprise Server is upgraded to 21.0.9.20, 22.2.10.35, 23.0.12.31, 24.0.12.30, 25.0.13.25, 26.0.13.22, 27.1.11.22, 28.0.14.13, 29.0.16.10, 30.0.17.5, 31.0.12 or 32.0.3

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N

Attack vector

Network

Complexity

Low

Privileges

Low

User interaction

Required

Confidentiality

High

Integrity

None

Availability

None

Scope

Changed

Exploitation

Is it being used?

Exploit prediction (EPSS)0.3% · higher than 17% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

security-advisories · nextcloud

>= 31.0.0, < 31.0.12; >= 32.0.0, < 32.0.3 · source: vendor

Nextcloud Server · Nextcloud

31.0.0 before 31.0.12; 32.0.0 before 32.0.3; 21.0.0 before 21.0.9.20; 22.0.0 before 22.2.10.35; 23.0.0 before 23.0.12.31; 24.0.0 before 24.0.12.30; +8 more · source: NVD

Affected product

security-advisories

nextcloud

All security-advisories CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2026-45810

CVE.org

https://www.cve.org/CVERecord?id=CVE-2026-45810

Vendor Advisory

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-285v-p9x9-cjhj

Issue Tracking

https://github.com/nextcloud/server/pull/56982

Permissions Required

https://hackerone.com/reports/3425534