Access Control Vulnerability in Nextcloud Content Collaboration Platform
CVE-2026-45154

2.6LOW

Key Information:

Vendor

Nextcloud
Status
Security-advisories
Vendor
CVE Published:
1 June 2026

What is CVE-2026-45154?

Nextcloud, a popular open-source content collaboration platform, has an access control vulnerability in versions 2.6.0 to before 4.3.0. This issue allows guests with view-only access to shared collectives to retrieve deleted pages directly from the trashbin. This behavior circumvents expected data protection measures and could lead to unauthorized viewing of sensitive information. The vulnerability is resolved in version 4.3.0, making it crucial for users to update to secure their collaborative environments.

Affected Version(s)

security-advisories >= 2.6.0, < 4.3.0

References

https://github.com/nextcloud/security-advisories/security...
x_refsource_CONFIRM
https://github.com/nextcloud/collectives/pull/2432
x_refsource_MISC
https://hackerone.com/reports/3521434
x_refsource_MISC

CVSS V3.1

Score:
2.6
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.