# CVE-2026-45543: Nextcloud Forms unauthorized file access after collaborator removal

Source: https://junglewise.ai/threats/cve-2026-45543-nextcloud-forms-unauthorized-file-access-after-collaborator  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-01. Updated: 2026-06-01  
License: CC BY 4.0 with a link back

CVE-2026-45543 · Severity: medium · CVSS 5.3 · Published 2026-06-01

Nextcloud Forms is a tool used to create surveys and collect data. A security flaw allowed former collaborators to continue viewing files uploaded by survey respondents even after their access to the form was revoked. This could lead to unauthorized access to sensitive documents or data submitted by users through these forms.

Technologies: [Nextcloud Forms](https://junglewise.ai/threats/technologies/forms). Vendors: [Nextcloud](https://junglewise.ai/threats/vendors/nextcloud).

## Quick answers

**Is CVE-2026-45543 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-45543 being exploited in the wild.

**How severe is CVE-2026-45543?** Medium severity, with a CVSS score of 5.3, published 1 June 2026.

**Which products and versions are affected?** Nextcloud Forms >= 4.3.0, < 5.2.7.

**Is there a fix for CVE-2026-45543?** A patch was published on 2026-04-14: Fix merged into main branch via pull request 3291 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-45543 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-45543?** Check whether you run Nextcloud Forms at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability classified as CWE-552 (Files or Directories Accessible to External Parties) exists in the Nextcloud Forms application. When a collaborator's access to a form is deleted, the system fails to properly clean up the associated file shares for the folder containing respondent uploads. Consequently, the removed user retains read access to those files via the Nextcloud Files interface. The issue affects versions 4.3.0 through 5.2.6 and is resolved in version 5.2.7 by ensuring file shares are synchronized with collaborator removal. Exploitation requires the attacker to have been a legitimate collaborator on the form previously.

## Affected products

- Nextcloud Forms >= 4.3.0, < 5.2.7

## Timeline

- 2026-04-14: patched: Fix merged into main branch via pull request 3291
- 2026-05-13: advisory: GitHub security advisory published
- 2026-06-01: disclosed: CVE published to NVD

## References

- [https://github.com/nextcloud/forms/pull/3291](https://github.com/nextcloud/forms/pull/3291)
- [https://github.com/nextcloud/security-advisories/security/advisories/GHSA-q4fw-6jf8-5vhh](https://github.com/nextcloud/security-advisories/security/advisories/GHSA-q4fw-6jf8-5vhh)
- [https://hackerone.com/reports/3617352](https://hackerone.com/reports/3617352)

## Related threats

- [Nextcloud Forms missing authorization in form submissions](https://junglewise.ai/threats/cve-2026-45267-nextcloud-forms-missing-authorization-in-form-submissions)