Nextcloud Circles CVE-2026-45285

Three specific conditions must simultaneously be true: (1) The Nextcloud Circles app must be installed and active on the instance; (2) At least one member of a Nextcloud Team/Circle must be an external member - a person added by email address who does not hold a Nextcloud account; (3) An authenticated Nextcloud user (PR:L) must share a folder or file with that Team, triggering the silent token generation in ShareByCircleProvider::create(). Beyond these prerequisites, the attacker must obtain the emailed link (AC:H), either as the intended external recipient or via email interception, making opportunistic mass exploitation unlikely. Exploitation is further constrained by the requirement for User Interaction (UI:R): a legitimate Nextcloud user must actively initiate the share. Instances not using external (email-only) members in Circles, or not using the Circles app at all, are entirely unaffected regardless of Nextcloud version.

The CVSS 6.4 score (AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N) accurately encodes the conditional nature of exploitation: AC:H reflects that the attacker must obtain the emailed link, PR:L confirms a low-privileged Nextcloud account is needed to initiate the share, and UI:R means a legitimate user must perform the share action. Despite these complexity factors, the confidentiality and integrity impacts are both rated High - once the link is obtained, the attacker exercises unrestricted data access and manipulation with no further authentication barrier. The hidden-link mechanism, which prevents the owner from discovering or revoking the exposure, meaningfully increases real-world risk beyond what the mid-range CVSS score implies. No EPSS score was provided in the input, so exploitation probability cannot be quantified. No CISA KEV listing is present, confirming no currently confirmed active exploitation. The HackerOne report (https://hackerone.com/reports/3625932) indicates responsible disclosure. For organizations actively using Circles with external members, the risk should be treated as operationally significant despite the 6.4 score.

A Nextcloud user shares a project folder with a Team that includes an external contractor added by email address. The system silently generates a public access token, stores it in the database without displaying it in the sharing UI, and emails the link to the external address. The contractor - or an attacker who compromises the contractor's email - opens the link in a browser without any Nextcloud credentials and gains full read, write, delete, reshare, and download access to the entire shared folder, exfiltrating sensitive documents or modifying files while the folder owner remains entirely unaware of the exposure.