What is the CVSS score of CVE-2026-45281?

CVE-2026-45281 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Nextcloud are affected by CVE-2026-45281?

Nextcloud Server versions 32.0.0-32.0.8 and 33.0.0-33.0.2 contain an authorization vulnerability in the CalDAV module allowing authenticated users to access and modify other users' calendars; no…. A patch is available.

How to fix or mitigate CVE-2026-45281?

Within 24 hours: Identify Nextcloud Server version across all deployments; disable CalDAV if operationally non-essential. Within 7 days: Review access logs for unauthorized calendar access; restrict CalDAV access via firewall rules to known trusted networks; audit and remove unnecessary calendar-sharing permissions. Within 30 days: Monitor Nextcloud security advisories for patch availability; execute upgrade to version 32.0.9+, 33.0.3+, or later immediately upon release.

Nextcloud CVE-2026-45281

EUVD-2026-33706 HIGH

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-06-01 GitHub_M

Authentication Bypass Nextcloud Security Advisories

8.1

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Primary rating from Vendor (GitHub_M) · only source for this CVE.

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Patch available

Jun 01, 2026 - 20:02 EUVD

Source Code Evidence Fetched

Jun 01, 2026 - 19:23 vuln.today

Analysis Generated

Jun 01, 2026 - 19:23 vuln.today

DescriptionCVE.org

Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, with the knowledge of other users’ principal URL an attacker could possibly send a request to gain full access to their calendar. Therefore, the attacker must be an authenticated user. This is because of improper authorization controls in the backend of the calendar. If the attacker had access to the calendar, they would be able to view and modify it. It is recommended that the Nextcloud Server is upgraded to 33.0.3 or 32.0.9. It is recommended that the Nextcloud Enterprise Server is upgraded to 33.0.3, 32.0.9, 31.0.14.5, 30.0.17.9, 29.0.16.16, 28.0.14.17, 27.1.11.26, 26.0.13.26, 25.0.13.29, 24.0.12.34, 23.0.12.35, 22.2.10.39, or 21.0.9.23

AnalysisAI

Improper authorization in the Nextcloud Server CalDAV backend allows an authenticated user who knows another user's principal URL to gain full read/write access to that user's calendar in versions 32.0.0 to before 32.0.9 and 33.0.0 to before 33.0.3. The flaw was reported via HackerOne (report 3545964) and patched in PR 59962 by introducing dedicated ProxyRead/ProxyWrite ACL-aware classes; no public exploit identified at time of analysis and the issue is not listed in CISA KEV.