CVE-2026-45282: Nextcloud Server access control bypass in Text attachments

CVE-2026-45282 · Severity: medium · CVSS 6.5 · Published 2026-06-01

Nextcloud is an open-source platform used for file sharing and collaboration. A security flaw allows logged-in users to bypass password protections or download restrictions on file attachments if they know the specific share token. While an attacker can access these attachments, they cannot access the primary shared file or the entire folder itself.

Quick answers

Is CVE-2026-45282 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-45282 being exploited in the wild.
How severe is CVE-2026-45282?
Medium severity, with a CVSS score of 6.5, published 1 June 2026.
Which products and versions are affected?
Nextcloud Nextcloud Server 32.0.0 to < 32.0.9, 33.0.0 to < 33.0.3; Nextcloud Nextcloud Enterprise Server 27.x to < 27.1.11.5, 28.x to < 28.0.14.17, 29.x to < 29.0.16.16, 30.x to < 30.0.17.9, 31.x to < 31.0.14.5, 32.x to < 32.0.9, 33.x to < 33.0.3.
Is there a fix for CVE-2026-45282?
A patch was published on 2026-04-22: Fix merged into main branch of Nextcloud Text repository. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-45282 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-45282?
Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An improper access control vulnerability (CWE-284) exists in the Nextcloud 'Text' application. Authenticated attackers who possess a valid share token can access file attachments by providing a 'documentId' they own, effectively bypassing password protections or download restrictions set on the share. For direct file shares, the attacker only needs the token and their own documentId; for shared folders, the attacker must know or guess a documentId of a file within that folder. The exploit is limited to extracting attachments and does not grant access to the primary shared file or folder. The issue is resolved by ensuring the share token is always validated when provided.

Affected products

  • Nextcloud Nextcloud Server 32.0.0 to < 32.0.9, 33.0.0 to < 33.0.3
  • Nextcloud Nextcloud Enterprise Server 27.x to < 27.1.11.5, 28.x to < 28.0.14.17, 29.x to < 29.0.16.16, 30.x to < 30.0.17.9, 31.x to < 31.0.14.5, 32.x to < 32.0.9, 33.x to < 33.0.3

Timeline

  • 2026-04-22: patched: Fix merged into main branch of Nextcloud Text repository.
  • 2026-05-12: advisory: Nextcloud security advisory published.
  • 2026-06-01: disclosed: CVE published to NVD.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.