What is the CVSS score of CVE-2026-45286?

CVE-2026-45286 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-45286?

Yes, a patch is available for CVE-2026-45286. Update the affected software to the latest version immediately.

Nextcloud Calendar CVE-2026-45286

EUVD-2026-33711 MEDIUM

Information Exposure (CWE-200)

2026-06-01 GitHub_M

Information Disclosure Nextcloud

4.3

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Jun 01, 2026 - 20:02 EUVD

Source Code Evidence Fetched

Jun 01, 2026 - 19:31 vuln.today

Analysis Generated

Jun 01, 2026 - 19:31 vuln.today

DescriptionGitHub Advisory

Nextcloud is an open source content collaboration platform. From versions 5.5.13 to before 5.5.17, and 6.2.0 to before 6.2.3, an authenticated user can enumerate users on the same Nextcloud instance by using the Calendar app's endpoint for suggesting attendees. The sharing restrictions, applied to other endpoints, were not effective here. This issue has been patched in versions 5.5.17 and 6.2.3.

AnalysisAI

User enumeration via Nextcloud Calendar's attendee suggestion endpoint affects authenticated users on versions 5.5.13-5.5.16 and 6.2.0-6.2.2. The searchAttendee controller method in ContactController.php called the contacts manager search API without passing the instance's configured sharing restriction parameters - meaning enumeration-limiting settings (shareapi_allow_share_dialog_user_enumeration, shareapi_only_share_with_group_members, group-scoped restrictions) enforced on all other sharing endpoints were silently bypassed here. An authenticated low-privilege attacker can probe the endpoint with partial name or email strings to reconstruct the full user directory, disclosing usernames and email addresses that administrators had intentionally restricted. No public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV not listed).

Technical ContextAI

The vulnerable code resides in lib/Controller/ContactController.php within the Nextcloud Calendar application (a separate installable app on top of the Nextcloud platform). Prior to the fix, searchAttendee() invoked $this->contactsManager->search($search, ['FN', 'EMAIL'], ['enumeration' => true]) - hardcoding enumeration: true and omitting the full set of sharing API config checks. The fix injects IConfig and IGroupManager dependencies and reads six core configuration keys (shareapi_allow_share_dialog_user_enumeration, shareapi_only_share_with_group_members, shareapi_restrict_user_enumeration_to_group, shareapi_restrict_user_enumeration_full_match, and related sub-settings) before filtering results, mirroring the logic applied to the main sharing dialog. The root cause class is CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor): a privileged access-control policy existed and was enforced elsewhere, but was not applied to this endpoint, creating an inconsistency that leaks data. The CPE cpe:2.3:a:nextcloud:security-advisories:*:*:*:*:*:*:*:* reflects the Nextcloud security advisory namespace rather than a narrowed product CPE; the precise affected artifact is the nextcloud/calendar composer package.

RemediationAI

Vendor-released patches are available: upgrade Nextcloud Calendar to version 5.5.17 (for the 5.x branch) or 6.2.3 (for the 6.x branch). The fix is implemented in PR #8197 (https://github.com/nextcloud/calendar/pull/8197), which has been merged and released. Administrators should update the Calendar app via the Nextcloud App Store or Composer. If immediate upgrade is not feasible, a compensating control is to disable the Nextcloud Calendar app entirely until patching is possible - this removes the vulnerable endpoint at the cost of calendar functionality for all users. Alternatively, if the organization's Nextcloud instance does not rely on user enumeration restrictions (i.e., shareapi_allow_share_dialog_user_enumeration is already set to 'yes' by policy), the practical confidentiality impact is negligible and the patch can be scheduled for the next maintenance window without emergency urgency. Restricting network access to the Nextcloud instance to trusted users only would reduce exposure but is not a targeted mitigiation. Vendor advisory: https://github.com/nextcloud/security-advisories/security/advisories/GHSA-r697-74m9-gvf2.