CVE-2026-45810

MEDIUM

Nextcloud Server 31.0.0-31.0.11 and 32.0.0-32.0.2 - Authenticated Unauthorized Comment Access

Title source: llm

Description

Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 31.0.0 to before 31.0.12, and 32.0.0 to before 32.0.3, a missing check of a relation allowed authenticated users with access to any file comment, to read the content of all comments. It is recommended that the Nextcloud Server is upgraded to 31.0.12 or 32.0.3. It is recommended that the Nextcloud Enterprise Server is upgraded to 21.0.9.20, 22.2.10.35, 23.0.12.31, 24.0.12.30, 25.0.13.25, 26.0.13.22, 27.1.11.22, 28.0.14.13, 29.0.16.10, 30.0.17.5, 31.0.12 or 32.0.3

References (3)

Core 3

Core References

Vendor Advisory x_refsource_confirm

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-285v-p9x9-cjhj

Issue Tracking x_refsource_misc

https://github.com/nextcloud/server/pull/56982

Third Party Advisory x_refsource_misc

https://hackerone.com/reports/3425534

Scores

CVSS v3 6.8

EPSS 0.0025

EPSS Percentile 16.2%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-639

Status published

Products (4)

nextcloud/nextcloud_server 21.0.0 - 21.0.9.20

nextcloud/nextcloud_server 31.0.0 - 31.0.12

nextcloud/security-advisories >= 31.0.0, < 31.0.12

nextcloud/security-advisories >= 32.0.0, < 32.0.3

Published Jun 01, 2026

Tracked Since Jun 02, 2026