Nextcloud Server vulnerabilities

Newest CVEs

• CVE-2026-82984

  When a team was configured as "visible to everyone", the web UI correctly blocked non-members from viewing the team ("You are not a member of ..."), but the…

  Nextcloud · Server

  Medium4.3
• CVE-2026-77167

  Abusing the federated share endpoint, an attacker can write arbitrary rows into the oc_share_external database table. These rows persist indefinitely — there…

  Nextcloud · server

  High7.5
• CVE-2026-77172

  App passwords were allowed to bypass password confirmation on sensitive endpoints.

  Nextcloud · Server

  Medium5.3
• CVE-2026-77165

  File owners were unable to unlock TYPE_TOKEN locks placed by other users, leaving files permanently locked with no recovery path outside of the database.

  Nextcloud · Server

  Medium6.5
• CVE-2026-68493

  After guessing a 62^15 complex unique identifier, a malicious logged in user was able to retrieve a list of memberships for a circle they are not a member of.

  Nextcloud · Server

  Low3.1
• CVE-2026-82985

  The Photos app's filter-based "smart albums" build their file listing using the search configuration (photosSourceFolders) of the user viewing the album,…

  Nextcloud · Server

  Medium6.5
• CVE-2026-77164

  Circles' remote-instance signature verification fetches the attacker-supplied keyId URL before trust in the remote instance is established, and explicitly…

  Nextcloud · Server

  Medium6.2