# CVE-2026-45281: Nextcloud Server authorization bypass in calendar delegation

Source: https://junglewise.ai/threats/cve-2026-45281-nextcloud-server-authorization-bypass-in-calendar-delegation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-01. Updated: 2026-06-01  
License: CC BY 4.0 with a link back

CVE-2026-45281 · Severity: high · CVSS 8.1 · Published 2026-06-01

Nextcloud is a content collaboration platform used for file sharing and scheduling. A security flaw allows an authenticated user to gain full access to another user's calendar if they know the target's specific URL. This could lead to the unauthorized viewing, modification, or deletion of sensitive meeting information and personal schedules.

Technologies: [Nextcloud Enterprise Server](https://junglewise.ai/threats/technologies/nextcloud-enterprise-server), [Nextcloud Server](https://junglewise.ai/threats/technologies/nextcloud-server). Vendors: [Nextcloud](https://junglewise.ai/threats/vendors/nextcloud).

## Quick answers

**Is CVE-2026-45281 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-45281 being exploited in the wild.

**How severe is CVE-2026-45281?** High severity, with a CVSS score of 8.1, published 1 June 2026.

**Which products and versions are affected?** Nextcloud Enterprise Server 21.0.0 to < 21.0.9.23, 22.0.0 to < 22.2.10.39, 23.0.0 to < 23.0.12.35, 24.0.0 to < 24.0.12.34, 25.0.0 to < 25.0.13.29, 26.0.0 to < 26.0.13.26, 27.0.0 to < 27.1.11.26, 28.0.0 to < 28.0.14.17, 29.0.0 to < 29.0.16.16, 30.0.0 to < 30.0.17.9, 31.0.0 to < 31.0.14.5, 32.0.0 to < 32.0.9, 33.0.0 to < 33.0.3; Nextcloud Server 32.0.0 to < 32.0.9, 33.0.0 to < 33.0.3.

**Is there a fix for CVE-2026-45281?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-45281 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-45281?** Check whether you run Nextcloud Enterprise Server or Nextcloud Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An authorization bypass (CWE-639) exists in the Nextcloud calendar backend due to improper Access Control List (ACL) enforcement during calendar delegation. An authenticated attacker who knows another user's principal URL can send crafted requests to the calendar-proxy endpoints to gain full read/write access to that user's calendar. The vulnerability affects the 'group-member-set' update mechanism within the CalDAV implementation. Exploitation requires network access and valid user credentials but no user interaction. Patches have been released for both Community and Enterprise editions to introduce proper ACLs for calendar delegation.

## Affected products

- Nextcloud Nextcloud Server 32.0.0 to < 32.0.9, 33.0.0 to < 33.0.3
- Nextcloud Nextcloud Enterprise Server 21.0.0 to < 21.0.9.23, 22.0.0 to < 22.2.10.39, 23.0.0 to < 23.0.12.35, 24.0.0 to < 24.0.12.34, 25.0.0 to < 25.0.13.29, 26.0.0 to < 26.0.13.26, 27.0.0 to < 27.1.11.26, 28.0.0 to < 28.0.14.17, 29.0.0 to < 29.0.16.16, 30.0.0 to < 30.0.17.9, 31.0.0 to < 31.0.14.5, 32.0.0 to < 32.0.9, 33.0.0 to < 33.0.3

## Timeline

- 2026-04-28: other: Fix pull request submitted to Nextcloud server repository
- 2026-05-12: advisory: GitHub Security Advisory published
- 2026-06-01: disclosed: CVE published to NVD

## References

- [https://github.com/nextcloud/security-advisories/security/advisories/GHSA-hrrv-mp25-26vv](https://github.com/nextcloud/security-advisories/security/advisories/GHSA-hrrv-mp25-26vv)
- [https://github.com/nextcloud/server/pull/59962](https://github.com/nextcloud/server/pull/59962)
- [https://hackerone.com/reports/3545964](https://hackerone.com/reports/3545964)

## Related threats

- [Nextcloud federated share endpoint unauthenticated database write](https://junglewise.ai/threats/cve-2026-77167-abusing-the-federated-share-endpoint-an-attacker-can-write)
- [Nextcloud Server authorization bypass in file comments](https://junglewise.ai/threats/cve-2026-45810-nextcloud-server-authorization-bypass-in-file-comments)
- [Nextcloud Server 2FA bypass in DAV endpoints via session cookie reuse](https://junglewise.ai/threats/cve-2026-45691-nextcloud-server-2fa-bypass-in-dav-endpoints-via-session-cookie)
- [Nextcloud Server 2FA bypass via session token replay](https://junglewise.ai/threats/cve-2026-45690-nextcloud-server-2fa-bypass-via-session-token-replay)
- [Nextcloud Server hidden public link creation in Teams sharing](https://junglewise.ai/threats/cve-2026-45285-nextcloud-server-hidden-public-link-creation-in-teams-sharing)