Nextcloud Server Vulnerability Allowing Unauthorized Attachment Access
CVE-2026-45282
6.5MEDIUM
What is CVE-2026-45282?
An access control vulnerability exists in Nextcloud Server, allowing authenticated attackers to access specific attachments from link shares if they have the share token. This vulnerability affects versions 32.0.0 through 32.0.8 and 33.0.0 through 33.0.2. While attackers can exploit this by knowing a document ID they own, the means to access shared folders is limited unless they can guess a document ID of a file within. This ensures a level of difficulty for exploitation but emphasizes the need for users to upgrade to the recommended versions for enhanced security.
Affected Version(s)
security-advisories >= 32.0.0, < 32.0.9 < 32.0.0, 32.0.9
security-advisories >= 33.0.0, < 33.0.3 < 33.0.0, 33.0.3