Quick answers
- Is CVE-2026-45545 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-45545 being exploited in the wild.
- How severe is CVE-2026-45545?
- High severity, with a CVSS score of 8.2, published 1 June 2026.
- Which products and versions are affected?
- Nextcloud Tables 0.7.0 to < 0.7.7, 0.8.0 to < 0.8.10, 0.9.0 to < 0.9.8, 1.0.0 to < 1.0.4.
- Is there a fix for CVE-2026-45545?
- A patch was published on 2026-02-12: Initial code refactor and validation fixes merged in GitHub Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-45545 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2026-45545?
- Check whether you run Nextcloud Tables at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A stored SQL injection vulnerability exists in the Nextcloud Tables app due to improper neutralization of the 'Column Type' parameter. An authenticated attacker with network access and low privileges can submit crafted input that is stored and later executed as part of an SQL command. While there is an initial 20-byte length limitation on the injection, researchers found that specific payloads can bypass this restriction to execute longer, more complex queries. This allows for unauthorized data extraction (Confidentiality) and data modification (Integrity). The issue is patched in versions 0.7.7, 0.8.10, 0.9.8, 1.0.4, and 2.0.0.
Affected products
- Nextcloud Tables 0.7.0 to < 0.7.7, 0.8.0 to < 0.8.10, 0.9.0 to < 0.9.8, 1.0.0 to < 1.0.4
Timeline
- 2026-02-12: patched: Initial code refactor and validation fixes merged in GitHub
- 2026-05-13: advisory: GitHub Security Advisory published by Nextcloud
- 2026-06-01: disclosed: CVE published to NVD dataset