Servers and applications

CVE-2026-45281

Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, with the knowledge of other users’ principal URL an attacker could possibly send a request to gain full access to their calendar. Therefore, the attacker must be an authenticated user. This is because of improper authorization controls in the backend…

Severity: High 8.1
Published: 1 Jun 2026
Last changed: 22 Jul 2026
Added to UpHeron: 21 Oct 2026
Fixed in: 28.0.14.17, 29.0.16.16, 30.0.17.9, 31.0.14.5, 32.0.9, 33.0.3
Sources: NVD

Affected software

Software Affected versions

Software	Affected versions
NextcloudServers and applications · `cpe:a:nextcloud:nextcloud_server`	From 33.0.0 before 33.0.3 From 32.0.0 before 32.0.9 From 31.0.0 before 31.0.14.5 From 30.0.0 before 30.0.17.9 All 13 release lines From 21.0.0 before 21.0.9.23 From 22.0.0 before 22.2.10.39 From 23.0.0 before 23.0.12.35 From 24.0.0 before 24.0.12.34 From 25.0.0 before 25.0.13.29 From 26.0.0 before 26.0.13.26 From 27.0.0 before 27.1.11.26 From 28.0.0 before 28.0.14.17 From 29.0.0 before 29.0.16.16 From 30.0.0 before 30.0.17.9 From 31.0.0 before 31.0.14.5 From 32.0.0 before 32.0.9 From 33.0.0 before 33.0.3

NextcloudServers and applications · cpe:a:nextcloud:nextcloud_server

From 33.0.0 before 33.0.3
From 32.0.0 before 32.0.9
From 31.0.0 before 31.0.14.5
From 30.0.0 before 30.0.17.9

All 13 release lines

From 21.0.0 before 21.0.9.23
From 22.0.0 before 22.2.10.39
From 23.0.0 before 23.0.12.35
From 24.0.0 before 24.0.12.34
From 25.0.0 before 25.0.13.29
From 26.0.0 before 26.0.13.26
From 27.0.0 before 27.1.11.26
From 28.0.0 before 28.0.14.17
From 29.0.0 before 29.0.16.16
From 30.0.0 before 30.0.17.9
From 31.0.0 before 31.0.14.5
From 32.0.0 before 32.0.9
From 33.0.0 before 33.0.3

References

NVD https://nvd.nist.gov/vuln/detail/CVE-2026-45281
CVE.org https://www.cve.org/CVERecord?id=CVE-2026-45281