Is CVE-2026-45285 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-45285 being exploited in the wild.

How severe is CVE-2026-45285?

Medium severity, with a CVSS score of 6.4, published 1 June 2026.

Which products and versions are affected?

Nextcloud Enterprise Server 32.0.0 to 32.0.8, 33.0.0 to 33.0.2; Nextcloud Server 32.0.0 to 32.0.8, 33.0.0 to 33.0.2.

Is there a fix for CVE-2026-45285?

A patch was published on 2026-04-23: Initial pull request to fix share handling in Circles component. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-45285 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-45285?

Check whether you run Nextcloud Enterprise Server or Nextcloud Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-45285: Nextcloud Server hidden public link creation in Teams sharing

CVE-2026-45285 · Severity: medium · CVSS 6.4 · Published 2026-06-01

Nextcloud is a collaboration platform used for storing and sharing files. A security flaw causes the system to automatically create hidden public access links when a folder is shared with a 'Team' that includes external email-based members. Because these links are not visible to the folder owner, they cannot be monitored or revoked, potentially allowing unauthorized individuals who obtain the link to view, modify, or delete sensitive company data.

Technologies: Nextcloud Enterprise Server, Nextcloud Server. Vendors: Nextcloud.

Quick answers

Is CVE-2026-45285 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-45285 being exploited in the wild.
How severe is CVE-2026-45285?: Medium severity, with a CVSS score of 6.4, published 1 June 2026.
Which products and versions are affected?: Nextcloud Enterprise Server 32.0.0 to 32.0.8, 33.0.0 to 33.0.2; Nextcloud Server 32.0.0 to 32.0.8, 33.0.0 to 33.0.2.
Is there a fix for CVE-2026-45285?: A patch was published on 2026-04-23: Initial pull request to fix share handling in Circles component. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-45285 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-45285?: Check whether you run Nextcloud Enterprise Server or Nextcloud Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A missing authorization and visibility flaw (CWE-862) exists in Nextcloud's 'Circles' or 'Teams' sharing logic. When a user shares a resource with a Team that includes external members (users identified only by email without a local account), the system generates a public access link and emails it to the external party. This link inherits the full permissions of the Team (read/write/delete/reshare) but is not registered in the folder's sharing interface, making it invisible to the owner. An attacker who intercepts or receives this link can perform unauthorized file operations without further authentication. The issue is resolved in versions 32.0.9 and 33.0.3.

Affected products

Nextcloud Nextcloud Server 32.0.0 to 32.0.8, 33.0.0 to 33.0.2
Nextcloud Nextcloud Enterprise Server 32.0.0 to 32.0.8, 33.0.0 to 33.0.2

Timeline

2026-04-23: patched: Initial pull request to fix share handling in Circles component.
2026-05-12: advisory: GitHub Security Advisory published.
2026-06-01: disclosed: CVE published to NVD.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.