What is the CVSS score of CVE-2026-45154?

CVE-2026-45154 has a CVSS 3.1 base score of 2.6 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-45154?

Yes, a patch is available for CVE-2026-45154. Update the affected software to the latest version immediately.

Nextcloud Collectives CVE-2026-45154

EUVD-2026-33673 LOW

Improper Access Control (CWE-284)

2026-06-01 GitHub_M

Authentication Bypass Nextcloud

2.6

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

2.6 LOW

AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Jun 01, 2026 - 18:01 EUVD

Source Code Evidence Fetched

Jun 01, 2026 - 17:19 vuln.today

Analysis Generated

Jun 01, 2026 - 17:19 vuln.today

DescriptionGitHub Advisory

Nextcloud is an open source content collaboration platform. From version 2.6.0 to before version 4.3.0, when a previous collective pages was deleted and the collective was shared view-only, guests with access to the collective were able to access the deleted pages directly from the trashbin. This issue has been patched in version 4.3.0.

AnalysisAI

Nextcloud Collectives versions 2.6.0 through 4.3.0 (exclusive) exposes deleted collective pages to unauthorized guests via a missing permission check in the public trash controller. Guests granted view-only access to a shared collective can bypass deletion-based access controls by directly querying trashbin endpoints, reading content that was intentionally removed. CVSS scores this at 2.6 (Low) with no public exploit identified at time of analysis and no CISA KEV listing, placing real-world priority at the lower end of the risk spectrum.

Technical ContextAI

Nextcloud Collectives is a Nextcloud application providing collaborative wiki-style page management. The vulnerability resides in PublicPageTrashController.php, where the trash retrieval path for public (guest) users omitted a call to checkEditPermissions() before serving deleted page content. CWE-284 (Improper Access Control) precisely describes this root cause: the access control gate enforced for active pages was simply absent on the trashbin endpoint. The PR diff at https://github.com/nextcloud/collectives/pull/2432 confirms the fix was a single-line addition of checkEditPermissions() to the relevant controller branch, demonstrating the narrowness of the oversight. The affected CPE is cpe:2.3:a:nextcloud:security-advisories:*:*:*:*:*:*:*:* per NVD, though functionally this is the Collectives component specifically.

RemediationAI

Upgrade Nextcloud Collectives to version 4.3.0, which introduces the missing checkEditPermissions() call in PublicPageTrashController.php as confirmed by the upstream fix at https://github.com/nextcloud/collectives/pull/2432. The vendor-released patch is version 4.3.0 per the security advisory GHSA-8mpv-ggq8-hf3w. If immediate upgrade is not possible, a compensating control is to revoke all view-only guest sharing of collectives containing sensitive pages and avoid sharing collectives where deleted-page confidentiality is a concern. Disabling the public share link for sensitive collectives entirely eliminates the exposed attack surface, though this removes intended collaboration functionality for those collectives.