Improper Authorization in Nextcloud Server Affects Calendar Functionality
CVE-2026-45281
What is CVE-2026-45281?
CVE-2026-45281 is a vulnerability found in Nextcloud Server, a widely used open-source content collaboration platform that facilitates file sharing, communication, and project management in organizational settings. This specific vulnerability arises from improper authorization controls within the calendar functionality of Nextcloud Server, affecting versions 32.0.0 to prior to 32.0.9 and 33.0.0 to prior to 33.0.3. An authenticated user can exploit this vulnerability to send requests that could grant them full access to another user's calendar by utilizing their principal URL. If exploited, the attacker could view and modify calendar events, potentially leading to unauthorized access to sensitive information and disruption of organizational operations.
Potential impact of CVE-2026-45281
-
Unauthorized Access to Calendar Data: Since an attacker could gain access to the calendar information of other users, this vulnerability allows for the potential exposure of confidential schedules, meetings, and events, severely undermining organizational privacy.
-
Data Manipulation: The ability of an unauthorized user to modify calendar entries could lead to scheduling conflicts, misinformation regarding meetings, or even the removal of critical events, compromising operational efficiency and trust among users.
-
Increased Risk of Phishing or Social Engineering: By accessing calendars, an attacker could use the information to launch targeted phishing attacks or social engineering schemes, leveraging legitimate events to trick users into disclosing additional sensitive information or taking harmful actions.
Affected Version(s)
security-advisories >= 32.0.0, < 32.0.9 < 32.0.0, 32.0.9
security-advisories >= 33.0.0, < 33.0.3 < 33.0.0, 33.0.3