LowCVSS 3.5
A missing token type check allowed to retrieve more additional information about the WOPI configuration with a user or guest token.
Vendor
Nextcloud vulnerabilities
362 published CVES affecting Nextcloud, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).
- Total
- 362
- Critical
- 9
- High
- 48
- Medium
- 226
- Low
- 78
- Unscored
- 1
- CISA KEV
- 0
Products
- security-advisories 173
- nextcloud server 98
- nextcloud 24
- talk 12
- Deck 11
- desktop 11
- Server 10
- contacts 5
- Richdocuments 5
- mail 4
- calendar 3
- circles 3
- Collectives 2
- news 2
- preferred providers 2
- social 2
- Tables 2
- @nextcloud/dialogs 1
- Approval 1
- cookbook 1
- end-to-end encryption 1
- extract 1
- Files Confidential 1
- Files Lock 1
- group folders 1
- lookup-server 1
- officeonline 1
- Team Folders 1
- whiteboard 1
Latest Nextcloud CVEs
Newest publication first · page 1 of 15
-
-
MediumCVSS 4.6
A SSRF vulnerability found that enables access to internal Chrome Devtools Protocol APIs that can leak the JWT authentication token for another user. A low privileged attacker could continually exploit this vulnerability to leak the JWT authentication token for another user when...
-
CVE-2026-77172 nextcloud: Nextcloud Server: Password confirmation bypass via application passwords
PublishedMediumCVSS 5.3App passwords were allowed to bypass password confirmation on sensitive endpoints.
-
CVE-2026-77171 A public shared collective always allowed recipients of the link to create pages.
PublishedLowCVSS 3.5A public shared collective always allowed recipients of the link to create pages.
-
HighCVSS 7.5
Abusing the federated share endpoint, an attacker can write arbitrary rows into the oc_share_external database table. These rows persist indefinitely — there is no automatic cleanup mechanism. Three distinct denial-of-service conditions follow from this write primitive, all trigg...
-
MediumCVSS 4.3
A user could create a docx or odt file with a # in the filename with confidential information such as a credit card number and have it not be marked as confidential.
-
MediumCVSS 4.6 EPSS 0.17%
The user in a group can bypass the group restriction set by an administrator on link sharing, creating share links for a table even though they shouldn't have that permission.
-
MediumCVSS 4.3 EPSS 0.27%
When a team was configured as "visible to everyone", the web UI correctly blocked non-members from viewing the team ("You are not a member of ..."), but the resources API endpoint could still be called directly, allowing any authenticated non-member to enumerate the team's intern...
-
LowCVSS 3.3 EPSS 0.11%
The Tables app's share-listing endpoint (GET /apps/tables/share/table/{tableId}) did not verify that the requesting user has manage-level permission on the table before returning the full list of share recipients (users, groups, and teams) along with their permission levels. A us...
-
LowCVSS 2.4
The emoji field in the page emoji update endpoint does not properly validate user input. By injecting long text and line breaks, the sidebar layout becomes broken and can hide other items.
-
MediumCVSS 6.5
File owners were unable to unlock TYPE_TOKEN locks placed by other users, leaving files permanently locked with no recovery path outside of the database.
-
LowCVSS 3.1
After guessing a 62^15 complex unique identifier, a malicious logged in user was able to retrieve a list of memberships for a circle they are not a member of.
-
CVE-2026-77170 Deck: Deck: Unauthorized configuration modification via improper access control
PublishedMediumCVSS 4.3The Deck config API allows authenticated users to set board-scoped configuration keys for arbitrary board IDs without validating whether the user owns or has permission to manage the referenced board.
-
MediumCVSS 6.2
Circles' remote-instance signature verification fetches the attacker-supplied keyId URL before trust in the remote instance is established, and explicitly allows local/private addresses for this request, bypassing Nextcloud's core SSRF protections. The public, unauthenticated end...
-
MediumCVSS 6.5
A vulnerability in the team folders (formerly group folders) app when used in combination with the workspace app allowed API/REST-only delegated administrators to bypass folder-level authorization controls. The workspace app enables organizations to delegate limited administrativ...
-
MediumCVSS 4.3 EPSS 0.33%
The Approval app's approve/reject endpoint is meant to require the file's current etag as a freshness check, preventing an approver from approving or rejecting a file whose contents changed after they reviewed it. The backend only enforced this check when the etag parameter was p...
-
MediumCVSS 6.5 EPSS 0.38%
The Photos app's filter-based "smart albums" build their file listing using the search configuration (photosSourceFolders) of the user viewing the album, rather than the album owner's configuration. When an album owner shares a smart album with another user, that user's own folde...
-
MediumCVSS 6.3 EPSS 0.30%
Any authenticated user can lock or unlock files they do not own by targeting absolute WebDAV paths of other users. The DAV plugin resolves files from the absolute request URI without verifying that the path segment matches the authenticated session user. This enables: Cross-user...
-
MediumCVSS 6.8
Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 31.0.0 to before 31.0.12, and 32.0.0 to before 32.0.3, a missing check of a relation allowed authenticated users with access to any file comment, to read the content of all comments. It...
-
HighCVSS 7.1
Nextcloud is an open source content collaboration platform. From versions 0.9.0 to before 0.9.7, and 1.0.0 to before 1.0.2, a missing sanitization in the Tables app allowed a user with access to the tables app to perform a limited SQL injection in the ORDER BY statement of a quer...
-
MediumCVSS 5.9
Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, a pre-2FA session cookie (created after successful password authentication but before TOTP completion) could be reused as a Bearer t...
-
CVE-2026-45690 Nextcloud: Two-Factor Authentication Bypass via Pending Session Token Replay
PublishedMediumCVSS 5.9Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, an authentication bypass vulnerability allowed attackers with knowledge of a user's password to circumvent two-factor authentication...
-
CVE-2026-45545 Nextcloud: SQL Injection in Column Type Parameter Allows Arbitrary SQL Execution
PublishedHighCVSS 8.2Nextcloud is an open source content collaboration platform. From versions 0.7.0 to before 0.7.7, 0.8.0 to before 0.8.10, 0.9.0 to before 0.9.8, and 1.0.0 to before 1.0.4, an authenticated attacker with access to the Tables app may be able to execute arbitrary up to 20 bytes long...
-
MediumCVSS 4.3
Nextcloud is an open source content collaboration platform. From version 0.8.0 to before version 1.0.4, the view filter criteria is exposed to users with read-only permissions in Nextcloud Tables. This issue has been patched in versions 1.0.4 and 2.0.0.
-
MediumCVSS 5.3
Nextcloud is an open source content collaboration platform. From version 4.3.0 to before version 5.2.7, a removed collaborator retains unauthorized read access to uploaded respondent files for the affected form. The scope is limited to uploaded files for forms where that user pre...
Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.