Is CVE-2026-45267 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-45267 being exploited in the wild.

How severe is CVE-2026-45267?

Medium severity, with a CVSS score of 6.5, published 1 June 2026.

Is there a fix for CVE-2026-45267?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-45267 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-45267?

Check whether you run Nextcloud Forms at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-45267: Nextcloud Forms missing authorization in form submissions

CVE-2026-45267 · Severity: medium · CVSS 6.5 · Published 2026-06-01

Nextcloud Forms is a tool used for creating and managing surveys and data collection forms. A security flaw in the application allowed logged-in users to view form responses submitted by other people without proper authorization. This could lead to the exposure of sensitive personal or business information collected through these forms.

Technologies: Nextcloud Forms. Vendors: Nextcloud.

Quick answers

Is CVE-2026-45267 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-45267 being exploited in the wild.
How severe is CVE-2026-45267?: Medium severity, with a CVSS score of 6.5, published 1 June 2026.
Which products and versions are affected?: Nextcloud Forms < 5.2.6.
Is there a fix for CVE-2026-45267?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-45267 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-45267?: Check whether you run Nextcloud Forms at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A missing authorization check (CWE-862) in the Nextcloud Forms application allowed authenticated users to access form submissions they were not authorized to view. The vulnerability resided in the ApiController where submission visibility was not properly enforced based on user permissions. An attacker with a valid account on the Nextcloud instance could exploit this by sending crafted network requests to the API to retrieve sensitive information (CWE-200) from other users' form responses. The issue has been resolved in version 5.2.6 by implementing proper permission validation in the submission handling logic.

Affected products

Nextcloud Forms < 5.2.6

Timeline

2026-04-04: other: Fix developed in pull request
2026-05-12: advisory: Vendor security advisory published
2026-06-01: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.