Information Disclosure in Nextcloud Server by Nextcloud
CVE-2026-45810

6.8MEDIUM

Key Information:

Vendor

Nextcloud
Status
Security-advisories
Vendor
CVE Published:
1 June 2026

What is CVE-2026-45810?

A vulnerability in Nextcloud Server enables authenticated users to access the content of all file comments due to a missing relational check. This oversight affects multiple versions of the platform, thereby exposing sensitive information to users who should not have access to it. To mitigate risks, users are encouraged to upgrade to the recommended versions immediately.

Affected Version(s)

security-advisories >= 31.0.0, < 31.0.12 < 31.0.0, 31.0.12

security-advisories >= 32.0.0, < 32.0.3 < 32.0.0, 32.0.3

References

https://github.com/nextcloud/security-advisories/security...
x_refsource_CONFIRM
https://github.com/nextcloud/server/pull/56982
x_refsource_MISC
https://hackerone.com/reports/3425534
x_refsource_MISC

CVSS V3.1

Score:
6.8
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.