What is the CVSS score of CVE-2026-45285?

CVE-2026-45285 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-45285?

Yes, a patch is available for CVE-2026-45285. Update the affected software to the latest version immediately.

Nextcloud Circles CVE-2026-45285

EUVD-2026-33709 MEDIUM

Missing Authorization (CWE-862)

2026-06-01 GitHub_M

Authentication Bypass Nextcloud

6.4

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.4 MEDIUM

AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Patch available

Jun 01, 2026 - 20:02 EUVD

Source Code Evidence Fetched

Jun 01, 2026 - 19:32 vuln.today

Analysis Generated

Jun 01, 2026 - 19:32 vuln.today

DescriptionGitHub Advisory

Nextcloud is an open source content collaboration platform. From versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, when a user shares a folder or file with a Nextcloud Team that includes an external member (a person added via email address who does not have a Nextcloud account), the system automatically creates a public link for that external member. This public link is not displayed in the share section of the folder, so the folder owner has no knowledge of its existence. It is sent via email to the external member. It grants the same permissions (read, write, delete, reshare, download) as the Team’s access. An attacker who receives or intercepts this link can access, modify, delete, reshare, and download all data in the shared folder without any further authentication. The folder owner cannot see or revoke the link through the normal sharing interface. This issue has been patched in versions 32.0.9 and 33.0.3.

AnalysisAI

Nextcloud's Circles (Teams) sharing feature silently generates unauthenticated public access links when folders are shared with a Team containing external email-only members, links which are never surfaced in the sharing UI and cannot be revoked by the folder owner. Affected are Nextcloud versions 32.0.0-32.0.8 and 33.0.0-33.0.2 with the Circles app in use. Any party who receives or intercepts the emailed link obtains full read, write, delete, reshare, and download access to the shared folder without a Nextcloud account, and the folder owner has no visibility or revocation path through normal interfaces. No public exploit identified at time of analysis; the issue was disclosed via HackerOne.

Technical ContextAI

The vulnerability resides in the Nextcloud Circles app (also marketed as Teams), which provides group-based sharing across Nextcloud. External members - users identified only by email address who lack Nextcloud accounts - are a supported member type in a Circle. The root cause, classified under CWE-862 (Missing Authorization), is that the ShareByCircleProvider's create() method automatically assigned a share token (equivalent to a public-link token) to every circle share record in the oc_share database table when an external member was present. This token was never rendered in the sharing UI, leaving the folder owner unaware of its existence. The token granted access equivalent to the Team's full permission set (read, write, delete, reshare, download), bypassing the expected Nextcloud account authentication. The PR diff at github.com/nextcloud/circles/pull/2454 confirms the fix: token generation was removed from ShareByCircleProvider::create(), and a live migration class RemoveShareTokens was introduced to NULL out all existing tokens for TYPE_CIRCLE shares in the database on upgrade.

RemediationAI

Upgrade Nextcloud to version 32.0.9 or 33.0.3, which contain the patched Circles app. The upgrade automatically executes the RemoveShareTokens live migration, which NULLs all existing share tokens for TYPE_CIRCLE shares in the oc_share table in batches of 1000 rows, thereby invalidating any pre-existing invisible public links - no manual revocation is required post-upgrade. The upstream code change is documented at https://github.com/nextcloud/circles/pull/2454 and the advisory at https://github.com/nextcloud/security-advisories/security/advisories/GHSA-r3xh-x86g-hw4m. As an immediate workaround prior to patching, administrators can disable the addition of external email-only members to Circles via Nextcloud admin settings; this prevents new invisible links from being generated but does not revoke tokens already created. Note that disabling external members will break existing collaboration workflows for any Teams currently using them. Alternatively, administrators can directly query the oc_share table and NULL the token column for all rows where share_type matches TYPE_CIRCLE, replicating the migration manually, though this approach carries database modification risk and should be tested in a non-production environment first.