# Nextcloud vulnerabilities Source: https://junglewise.ai/threats/vendors/nextcloud Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/nextcloud.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 52 vulnerabilities in Nextcloud: 0 in the last 7 days and 7 in the last 90 days, 1 of them critical and 0 exploited in the wild. The most recent, CVE-2026-107059, was published on 29 October 2026. 3 vulnerabilities in the last four weeks, down 25% on the four before (4). 7 technologies have a page of their own. ## Counts - Last 7 days: 0 - Last 30 days: 3 - Last 90 days: 7 - All time: 52 (1 critical, 0 exploited in the wild) ## About Nextcloud A developer of open-source software for self-hosted file synchronization, sharing, and content collaboration. ## Latest Nextcloud vulnerabilities - [CVE-2026-107059: Nextcloud Android authentication bypass via exported activity](https://junglewise.ai/threats/cve-2026-107059-an-issue-in-nextcloud-versioncode-30390190-allows-attackers-to) (info, published 29 Oct 2026) - [CVE-2026-77167: Nextcloud federated share endpoint unauthenticated database write](https://junglewise.ai/threats/cve-2026-77167-abusing-the-federated-share-endpoint-an-attacker-can-write) (high, CVSS 7.5, published 27 Oct 2026) - [CVE-2026-104189: Nextcloud 3D Viewer password bypass in public file endpoint](https://junglewise.ai/threats/cve-2026-104189-the-3d-viewer-for-nextcloud-is-a-comprehensive-3d-model-viewer) (high, CVSS 7.5, published 27 Oct 2026) - [CVE-2026-82982: Nextcloud Approval app freshness check bypass in approve/reject endpoint](https://junglewise.ai/threats/cve-2026-82982-nextcloud-approval-app-freshness-check-bypass-in-approve-reject) (medium, CVSS 4.3, published 18 Sep 2026) - [CVE-2026-77170: Nextcloud Deck authorization bypass in config API](https://junglewise.ai/threats/cve-2026-77170-nextcloud-deck-authorization-bypass-in-config-api) (medium, CVSS 4.3, published 18 Sep 2026) - [CVE-2026-77169: Nextcloud Team Folders authorization bypass in workspace app](https://junglewise.ai/threats/cve-2026-77169-nextcloud-team-folders-authorization-bypass-in-workspace-app) (medium, CVSS 6.5, published 18 Sep 2026) - [CVE-2026-77164: Nextcloud Circles remote-instance signature verification SSRF](https://junglewise.ai/threats/cve-2026-77164-nextcloud-circles-remote-instance-signature-verification-ssrf) (medium, CVSS 6.2, published 18 Sep 2026) - [CVE-2026-45810: Nextcloud Server authorization bypass in file comments](https://junglewise.ai/threats/cve-2026-45810-nextcloud-server-authorization-bypass-in-file-comments) (medium, CVSS 6.8, published 1 Jun 2026) - [CVE-2026-45722: Nextcloud Tables SQL injection in ORDER BY statement](https://junglewise.ai/threats/cve-2026-45722-nextcloud-tables-sql-injection-in-order-by-statement) (high, CVSS 7.1, published 1 Jun 2026) - [CVE-2026-45691: Nextcloud Server 2FA bypass in DAV endpoints via session cookie reuse](https://junglewise.ai/threats/cve-2026-45691-nextcloud-server-2fa-bypass-in-dav-endpoints-via-session-cookie) (medium, CVSS 5.9, published 1 Jun 2026) - [CVE-2026-45690: Nextcloud Server 2FA bypass via session token replay](https://junglewise.ai/threats/cve-2026-45690-nextcloud-server-2fa-bypass-via-session-token-replay) (medium, CVSS 5.9, published 1 Jun 2026) - [CVE-2026-45545: Nextcloud Tables SQL injection in Column Type parameter](https://junglewise.ai/threats/cve-2026-45545-nextcloud-tables-sql-injection-in-column-type-parameter) (high, CVSS 8.2, published 1 Jun 2026) - [CVE-2026-45544: Nextcloud Tables information disclosure in ViewService filter criteria](https://junglewise.ai/threats/cve-2026-45544-nextcloud-tables-information-disclosure-in-viewservice-filter) (medium, CVSS 4.3, published 1 Jun 2026) - [CVE-2026-45543: Nextcloud Forms unauthorized file access after collaborator removal](https://junglewise.ai/threats/cve-2026-45543-nextcloud-forms-unauthorized-file-access-after-collaborator) (medium, CVSS 5.3, published 1 Jun 2026) - [CVE-2026-45286: Nextcloud Calendar user enumeration via attendee suggestion endpoint](https://junglewise.ai/threats/cve-2026-45286-nextcloud-calendar-user-enumeration-via-attendee-suggestion) (medium, CVSS 4.3, published 1 Jun 2026) - [CVE-2026-45285: Nextcloud Server hidden public link creation in Teams sharing](https://junglewise.ai/threats/cve-2026-45285-nextcloud-server-hidden-public-link-creation-in-teams-sharing) (medium, CVSS 6.4, published 1 Jun 2026) - [CVE-2026-45284: Nextcloud User OIDC improper access control for deleted LDAP users](https://junglewise.ai/threats/cve-2026-45284-nextcloud-user-oidc-improper-access-control-for-deleted-ldap) (medium, CVSS 4.6, published 1 Jun 2026) - [CVE-2026-45283: Nextcloud Server improper authentication in files_lock app](https://junglewise.ai/threats/cve-2026-45283-nextcloud-server-improper-authentication-in-files-lock-app) (medium, CVSS 6.3, published 1 Jun 2026) - [CVE-2026-45282: Nextcloud Server access control bypass in Text attachments](https://junglewise.ai/threats/cve-2026-45282-nextcloud-server-access-control-bypass-in-text-attachments) (medium, CVSS 6.5, published 1 Jun 2026) - [CVE-2026-45281: Nextcloud Server authorization bypass in calendar delegation](https://junglewise.ai/threats/cve-2026-45281-nextcloud-server-authorization-bypass-in-calendar-delegation) (high, CVSS 8.1, published 1 Jun 2026) - [CVE-2026-45278: Nextcloud User OIDC open redirect in login flow](https://junglewise.ai/threats/cve-2026-45278-nextcloud-user-oidc-open-redirect-in-login-flow) (low, CVSS 3.3, published 1 Jun 2026) - [CVE-2026-45277: Nextcloud Approval app information disclosure via fileId parameter](https://junglewise.ai/threats/cve-2026-45277-nextcloud-approval-app-information-disclosure-via-fileid) (low, CVSS 3.3, published 1 Jun 2026) - [CVE-2026-45275: Nextcloud Approval app privilege escalation in file sharing](https://junglewise.ai/threats/cve-2026-45275-nextcloud-approval-app-privilege-escalation-in-file-sharing) (medium, CVSS 6.5, published 1 Jun 2026) - [CVE-2026-45267: Nextcloud Forms missing authorization in form submissions](https://junglewise.ai/threats/cve-2026-45267-nextcloud-forms-missing-authorization-in-form-submissions) (medium, CVSS 6.5, published 1 Jun 2026) - [CVE-2026-45264: Nextcloud Team Folders improper access control in file renaming](https://junglewise.ai/threats/cve-2026-45264-nextcloud-team-folders-improper-access-control-in-file-renaming) (medium, CVSS 4.3, published 1 Jun 2026) ## Most severe Nextcloud vulnerabilities - [CVE-2026-23696: Windmill Labs Windmill SQL injection in folder ownership management](https://junglewise.ai/threats/cve-2026-23696-windmill-labs-windmill-sql-injection-in-folder-ownership) (critical, CVSS 9.9, published 7 Apr 2026) - [CVE-2026-22683: Windmill versions 1.56.0 through 1.614.0 contain a missing authorization vulnerability that allows users with the…](https://junglewise.ai/threats/cve-2026-22683-windmill-versions-1-56-0-through-1-614-0-contain-a-missing) (high, CVSS 8.8, published 7 Apr 2026) - [CVE-2026-45545: Nextcloud Tables SQL injection in Column Type parameter](https://junglewise.ai/threats/cve-2026-45545-nextcloud-tables-sql-injection-in-column-type-parameter) (high, CVSS 8.2, published 1 Jun 2026) - [CVE-2026-45281: Nextcloud Server authorization bypass in calendar delegation](https://junglewise.ai/threats/cve-2026-45281-nextcloud-server-authorization-bypass-in-calendar-delegation) (high, CVSS 8.1, published 1 Jun 2026) - [CVE-2026-45156: Nextcloud User OIDC authentication bypass via missing signature verification](https://junglewise.ai/threats/cve-2026-45156-nextcloud-user-oidc-authentication-bypass-via-missing-signature) (high, CVSS 8.1, published 1 Jun 2026) - [CVE-2026-77167: Nextcloud federated share endpoint unauthenticated database write](https://junglewise.ai/threats/cve-2026-77167-abusing-the-federated-share-endpoint-an-attacker-can-write) (high, CVSS 7.5, published 27 Oct 2026) - [CVE-2026-104189: Nextcloud 3D Viewer password bypass in public file endpoint](https://junglewise.ai/threats/cve-2026-104189-the-3d-viewer-for-nextcloud-is-a-comprehensive-3d-model-viewer) (high, CVSS 7.5, published 27 Oct 2026) - [CVE-2026-45722: Nextcloud Tables SQL injection in ORDER BY statement](https://junglewise.ai/threats/cve-2026-45722-nextcloud-tables-sql-injection-in-order-by-statement) (high, CVSS 7.1, published 1 Jun 2026) - [CVE-2026-45810: Nextcloud Server authorization bypass in file comments](https://junglewise.ai/threats/cve-2026-45810-nextcloud-server-authorization-bypass-in-file-comments) (medium, CVSS 6.8, published 1 Jun 2026) - [CVE-2026-77169: Nextcloud Team Folders authorization bypass in workspace app](https://junglewise.ai/threats/cve-2026-77169-nextcloud-team-folders-authorization-bypass-in-workspace-app) (medium, CVSS 6.5, published 18 Sep 2026) ## Vulnerabilities per week 3 vulnerabilities in the last four weeks, down 25% on the four before (4). | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 4 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 3 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Nextcloud technologies - [Nextcloud Server](https://junglewise.ai/threats/technologies/nextcloud-server): 14 vulnerabilities - [Nextcloud Enterprise Server](https://junglewise.ai/threats/technologies/nextcloud-enterprise-server): 7 vulnerabilities - [Nextcloud Tables](https://junglewise.ai/threats/technologies/tables): 5 vulnerabilities - [Nextcloud Approval](https://junglewise.ai/threats/technologies/approval): 4 vulnerabilities - [Nextcloud Calendar](https://junglewise.ai/threats/technologies/calendar): 4 vulnerabilities - [Nextcloud Forms](https://junglewise.ai/threats/technologies/forms): 4 vulnerabilities - [Nextcloud User OIDC](https://junglewise.ai/threats/technologies/user-oidc): 3 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Nextcloud vulnerabilities", https://junglewise.ai/threats/vendors/nextcloud, 9 November 2026.