What is the CVSS score of CVE-2026-45264?

CVE-2026-45264 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-45264?

Yes, a patch is available for CVE-2026-45264. Update the affected software to the latest version immediately.

Nextcloud Groupfolders CVE-2026-45264

EUVD-2026-33671 MEDIUM

Improper Access Control (CWE-284)

2026-06-01 GitHub_M

Authentication Bypass Nextcloud

4.3

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Patch available

Jun 01, 2026 - 18:01 EUVD

Source Code Evidence Fetched

Jun 01, 2026 - 17:25 vuln.today

Analysis Generated

Jun 01, 2026 - 17:25 vuln.today

DescriptionGitHub Advisory

Nextcloud is an open source content collaboration platform. From versions 17.0.0 to before 17.0.15, 18.0.0 to before 18.1.12, 19.0.0 to before 19.1.16, 20.0.0 to before 20.1.11, and 21.0.0 to before 21.0.4, a user with READ and CREATE permission, but no UPDATE permission for a team folder can rename files in the team folder. This issue has been patched in versions 17.0.15, 18.1.12, 19.1.16, 20.1.11, and 21.0.4.

AnalysisAI

Rename permission bypass in Nextcloud's team folder (groupfolders) feature allows authenticated low-privileged users holding READ and CREATE permissions to rename files in team folders even when UPDATE permission is explicitly denied. Affecting Nextcloud versions 17.0.0 through 21.0.3, the flaw originates from a single-character bitwise operator error in ACLStorageWrapper.php - a & used instead of | when evaluating combined permission flags effectively nullifies the UPDATE permission check. No public exploit identified at time of analysis; vendor-released patches are available across all affected version branches.

Technical ContextAI

The vulnerability resides in the groupfolders (team folders) plugin's lib/ACL/ACLStorageWrapper.php, specifically in the rename() method's ACL permission check. Nextcloud uses bitmask constants to represent permissions (READ, CREATE, UPDATE, etc.); combining them correctly requires bitwise OR (|) to check that a user holds all required permissions. The defective code used bitwise AND (&) between PERMISSION_UPDATE and PERMISSION_READ, which - since these are distinct non-overlapping bit flags - evaluates to zero, causing checkPermissions() to receive a trivially-satisfied operand and bypass the UPDATE requirement entirely. CWE-284 (Improper Access Control) is the accurate root cause class: the access control boundary between CREATE and UPDATE permissions is not correctly enforced at the storage wrapper layer. The CPE string cpe:2.3:a:nextcloud:security-advisories covers the Nextcloud application suite as reported by NVD.

RemediationAI

Upgrade Nextcloud to one of the vendor-patched releases: 17.0.15, 18.1.12, 19.1.16, 20.1.11, or 21.0.4, which incorporate the corrected bitwise OR operator in ACLStorageWrapper.php via groupfolders PR #4361 (https://github.com/nextcloud/groupfolders/pull/4361). Full vendor advisory is at https://github.com/nextcloud/security-advisories/security/advisories/GHSA-wx2x-822r-rvmf. If an immediate upgrade cannot be applied, the most targeted compensating control is to audit team folder ACL configurations and remove CREATE permission from any user who does not also hold UPDATE permission - this eliminates the exploitable READ+CREATE-without-UPDATE permission subset, though it restricts legitimate file creation for those users. Alternatively, temporarily revoking groupfolders access for sensitive team folders until the patch is applied eliminates exposure entirely, at the cost of disrupting collaboration workflows.