# CVE-2026-45544: Nextcloud Tables information disclosure in ViewService filter criteria

Source: https://junglewise.ai/threats/cve-2026-45544-nextcloud-tables-information-disclosure-in-viewservice-filter  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-01. Updated: 2026-06-01  
License: CC BY 4.0 with a link back

CVE-2026-45544 · Severity: medium · CVSS 4.3 · Published 2026-06-01

Nextcloud Tables, a tool for managing structured data within the Nextcloud collaboration platform, contains a vulnerability where data filtering rules are not properly hidden. This allows users who only have permission to view specific parts of a table to see the underlying criteria used to filter that data. While this does not allow unauthorized modification of data, it can lead to the exposure of sensitive metadata or internal logic that should remain restricted.

Technologies: [Nextcloud Tables](https://junglewise.ai/threats/technologies/tables). Vendors: [Nextcloud](https://junglewise.ai/threats/vendors/nextcloud).

## Quick answers

**Is CVE-2026-45544 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-45544 being exploited in the wild.

**How severe is CVE-2026-45544?** Medium severity, with a CVSS score of 4.3, published 1 June 2026.

**Which products and versions are affected?** Nextcloud Tables >=0.8.0, <1.0.4; >=2.0.0 (patched).

**Is there a fix for CVE-2026-45544?** A patch was published on 2026-02-12: Fix merged into main branch and backported to stable1.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-45544 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-45544?** Check whether you run Nextcloud Tables at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An information disclosure vulnerability exists in the Nextcloud Tables 'ViewService' due to broken sensitive data masking. The application fails to sufficiently limit access to metadata derived from sensitive information, specifically exposing view filter criteria to users who should only have read-only access to the filtered results. An authenticated attacker with network access and low privileges can exploit this to view internal filter logic (CWE-1230). The vulnerability is addressed by ensuring the ViewService returns empty or masked results for filter metadata when accessed by unauthorized users. Patches are available in versions 1.0.4 and 2.0.0.

## Affected products

- Nextcloud Tables >=0.8.0, <1.0.4; >=2.0.0 (patched)

## Timeline

- 2026-02-12: patched: Fix merged into main branch and backported to stable1.0
- 2026-05-13: advisory: GitHub Security Advisory GHSA-vvxm-6jjp-m9mp published
- 2026-06-01: disclosed: CVE-2026-45544 published to NVD

## References

- [https://github.com/nextcloud/security-advisories/security/advisories/GHSA-vvxm-6jjp-m9mp](https://github.com/nextcloud/security-advisories/security/advisories/GHSA-vvxm-6jjp-m9mp)
- [https://github.com/nextcloud/tables/pull/2312](https://github.com/nextcloud/tables/pull/2312)
- [https://hackerone.com/reports/3483753](https://hackerone.com/reports/3483753)

## Related threats

- [Nextcloud Tables SQL injection in ORDER BY statement](https://junglewise.ai/threats/cve-2026-45722-nextcloud-tables-sql-injection-in-order-by-statement)
- [Nextcloud Tables SQL injection in Column Type parameter](https://junglewise.ai/threats/cve-2026-45545-nextcloud-tables-sql-injection-in-column-type-parameter)
- [Nextcloud Tables allows you to create your own tables with individual columns. Prior to 0.8.7 and 0.9.4, authenticated…](https://junglewise.ai/threats/cve-2025-66553-nextcloud-tables-allows-you-to-create-your-own-tables-with)
- [Nextcloud Tables allows you to create your own tables with individual columns. Prior to 0.8.9, 0.9.6, and 1.0.1, the…](https://junglewise.ai/threats/cve-2025-66513-nextcloud-tables-allows-you-to-create-your-own-tables-with)