CVE-2026-45281
published 2026-06-01CVE-2026-45281: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, with the…
PriorityP354high8.1CVSS 3.1
AVNACLPRLUINSUCHIHAN
EPSS
0.28%
20.1th percentile
Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, with the knowledge of other users’ principal URL an attacker could possibly send a request to gain full access to their calendar. Therefore, the attacker must be an authenticated user. This is because of improper authorization controls in the backend of the calendar. If the attacker had access to the calendar, they would be able to view and modify it. It is recommended that the Nextcloud Server is upgraded to 33.0.3 or 32.0.9. It is recommended that the Nextcloud Enterprise Server is upgraded to 33.0.3, 32.0.9, 31.0.14.5, 30.0.17.9, 29.0.16.16, 28.0.14.17, 27.1.11.26, 26.0.13.26, 25.0.13.29, 24.0.12.34, 23.0.12.35, 22.2.10.39, or 21.0.9.23
Affected
15 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| nextcloud | nextcloud_server | >= 21.0.0 < 21.0.9.23 | 21.0.9.23 |
| nextcloud | nextcloud_server | >= 22.0.0 < 22.2.10.39 | 22.2.10.39 |
| nextcloud | nextcloud_server | >= 23.0.0 < 23.0.12.35 | 23.0.12.35 |
| nextcloud | nextcloud_server | >= 24.0.0 < 24.0.12.34 | 24.0.12.34 |
| nextcloud | nextcloud_server | >= 25.0.0 < 25.0.13.29 | 25.0.13.29 |
| nextcloud | nextcloud_server | >= 26.0.0 < 26.0.13.26 | 26.0.13.26 |
| nextcloud | nextcloud_server | >= 27.0.0 < 27.1.11.26 | 27.1.11.26 |
| nextcloud | nextcloud_server | >= 28.0.0 < 28.0.14.17 | 28.0.14.17 |
| nextcloud | nextcloud_server | >= 29.0.0 < 29.0.16.16 | 29.0.16.16 |
| nextcloud | nextcloud_server | >= 30.0.0 < 30.0.17.9 | 30.0.17.9 |
| nextcloud | nextcloud_server | >= 31.0.0 < 31.0.14.5 | 31.0.14.5 |
| nextcloud | nextcloud_server | >= 32.0.0 < 32.0.9 | 32.0.9 |
| nextcloud | nextcloud_server | >= 33.0.0 < 33.0.3 | 33.0.3 |
| nextcloud | security-advisories | — | — |
| nextcloud | security-advisories | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-45281 nextcloud: Nextcloud Server: Authenticated users can gain full calendar access due to improper authorization. [epel-all]
bugzilla·2026-06-01·CVSS 8.1
CVE-2026-45281 [HIGH] CVE-2026-45281 nextcloud: Nextcloud Server: Authenticated users can gain full calendar access due to improper authorization. [epel-all]
CVE-2026-45281 nextcloud: Nextcloud Server: Authenticated users can gain full calendar access due to improper authorization. [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2026-45281 nextcloud-server: Nextcloud Server: Authenticated users can gain full calendar access due to improper authorization.
bugzilla·2026-06-01·CVSS 8.1
CVE-2026-45281 [HIGH] CVE-2026-45281 nextcloud-server: Nextcloud Server: Authenticated users can gain full calendar access due to improper authorization.
CVE-2026-45281 nextcloud-server: Nextcloud Server: Authenticated users can gain full calendar access due to improper authorization.
Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, with the knowledge of other users’ principal URL an attacker could possibly send a request to gain full access to their calendar. Therefore, the attacker must be an authenticated user. This is because of improper authorization controls in the backend of the calendar. If the attacker had access to the calendar, they would be able to view and modify it. It is recommended that the Nextcloud Server is upgraded to 33.0.3 or 32.0.9. It is recommended that the Nextcloud Enterprise Server is upgraded to 33.0.3, 32.0.9, 31
Bugzilla
CVE-2026-45281 nextcloud: Nextcloud Server: Authenticated users can gain full calendar access due to improper authorization. [fedora-all]
bugzilla·2026-06-01·CVSS 8.1
CVE-2026-45281 [HIGH] CVE-2026-45281 nextcloud: Nextcloud Server: Authenticated users can gain full calendar access due to improper authorization. [fedora-all]
CVE-2026-45281 nextcloud: Nextcloud Server: Authenticated users can gain full calendar access due to improper authorization. [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
2026-06-01
Published