What is the CVSS score of CVE-2026-45282?

CVE-2026-45282 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-45282?

Yes, a patch is available for CVE-2026-45282. Update the affected software to the latest version immediately.

Nextcloud Server CVE-2026-45282

EUVD-2026-33707 MEDIUM

Improper Access Control (CWE-284)

2026-06-01 GitHub_M

Authentication Bypass Nextcloud Security Advisories

6.5

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from Vendor (GitHub_M) · only source for this CVE.

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Jun 01, 2026 - 20:02 EUVD

Source Code Evidence Fetched

Jun 01, 2026 - 19:33 vuln.today

Analysis Generated

Jun 01, 2026 - 19:33 vuln.today

DescriptionCVE.org

Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, an authenticated attacker can access attachments of link shares when knowing the share token, circumventing password protection or download restrictions. It is applicable to any file that is shared directly, as the attacker only needs to know a documentId they own, apart of the mentioned share token. For shared folders the attacker has to know or guess a documentId of a file that is included inside the folder, making it much harder to exploit. The attacker can only extract an attachments, but not the file shared file or folder itself. It is recommended that the Nextcloud Server is upgraded to 33.0.3 or 32.0.9. It is recommended that the Nextcloud Enterprise Server is upgraded to 33.0.3, 32.0.9, 31.0.14.5, 30.0.17.9, 29.0.16.16, 28.0.14.17 or 27.1.11.5

AnalysisAI

Nextcloud Server's link share attachment access bypasses password protection and download restrictions for authenticated users who possess a valid share token. Affecting versions 32.0.0-32.0.9 and 33.0.0-33.0.3 of Nextcloud Server (with broader version ranges for Enterprise), an attacker authenticated to the Nextcloud instance can retrieve attachments from password-protected or download-restricted link shares by supplying a documentId they own alongside a known share token-circumventing the intended access controls entirely. No public exploit has been identified at time of analysis, and no CISA KEV listing exists; however, the CVSS vector (AV:N/AC:L/PR:L/UI:N) indicates straightforward network exploitation by any authenticated user.

Technical ContextAI

The vulnerability resides in the Nextcloud Text collaborative editing app's SessionMiddleware (lib/Middleware/SessionMiddleware.php), which governs access to document sessions tied to link shares. The affected component is identified via CPE as cpe:2.3:a:nextcloud:security-advisories:*:*:*:*:*:*:*:*. The root cause (CWE-284: Improper Access Control) stems from incorrect ordering of authorization checks in the assertDocumentSession() method: the original code evaluated whether the authenticated user owned a given documentId before validating the share token, allowing the ownership check to short-circuit and return early without enforcing password protection or download restrictions on the share. The fix, implemented in GitHub PR #8499 against nextcloud/text, relocates the authenticated-user document-ownership check from assertDocumentSession() to assertUserOrShareToken(), ensuring share token validation-including password and permission checks-always executes first. This is a logic-ordering flaw, not a missing check, which makes it easy to miss in code review but straightforward to fix.

RemediationAI

The primary remediation is to upgrade Nextcloud Server to version 32.0.9 or 33.0.3 as recommended by the vendor advisory at https://github.com/nextcloud/security-advisories/security/advisories/GHSA-35fx-69q6-xpjr. For Nextcloud Enterprise Server, upgrade to the appropriate patched release for your branch: 27.1.11.5, 28.0.14.17, 29.0.16.16, 30.0.17.9, 31.0.14.5, 32.0.9, or 33.0.3. The upstream fix is tracked in nextcloud/text PR #8499 (https://github.com/nextcloud/text/pull/8499). As a compensating control for environments that cannot immediately upgrade, administrators may consider disabling the Nextcloud Text collaborative editing app, which hosts the vulnerable SessionMiddleware-note this will disable the collaborative text editor functionality for all users and is a significant operational trade-off. Restricting link share creation to trusted user groups reduces the attacker's ability to obtain share tokens via social engineering. Removing password protection from link shares (counterintuitively) eliminates the specific bypass scenario, though this broadens share exposure and should only be considered as a last resort documentation measure, not a security improvement.