What is the CVSS score of CVE-2026-45543?

CVE-2026-45543 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-45543?

Yes, a patch is available for CVE-2026-45543. Update the affected software to the latest version immediately.

Nextcloud Forms CVE-2026-45543

EUVD-2026-33713 MEDIUM

Files or Directories Accessible to External Parties (CWE-552)

2026-06-01 GitHub_M

Information Disclosure Path Traversal Nextcloud

5.3

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Jun 01, 2026 - 20:02 EUVD

Source Code Evidence Fetched

Jun 01, 2026 - 19:30 vuln.today

Analysis Generated

Jun 01, 2026 - 19:30 vuln.today

DescriptionGitHub Advisory

Nextcloud is an open source content collaboration platform. From version 4.3.0 to before version 5.2.7, a removed collaborator retains unauthorized read access to uploaded respondent files for the affected form. The scope is limited to uploaded files for forms where that user previously had results access. This issue has been patched in version 5.2.7.

AnalysisAI

Broken share revocation in Nextcloud Forms versions 4.3.0 through 5.2.7 leaves former collaborators with persistent read access to uploaded respondent files after removal. The vulnerability stems from a two-layer share architecture where removing a collaborator deleted the Forms-layer share record but silently preserved the underlying Nextcloud Files-layer share on the uploaded files folder - meaning removed users retained filesystem-level access to sensitive form submission files. No public exploit has been identified at time of analysis and the issue is not listed in CISA KEV, but the low-complexity network vector (CVSS AV:N/AC:L/PR:N/UI:N) means a removed collaborator can exploit this passively without any additional action.

Technical ContextAI

Nextcloud Forms implements collaborator access through two coupled share records: a Forms-application share (tracked in the Forms database with permissions like PERMISSION_RESULTS) and a corresponding Nextcloud Files share on the folder where uploaded respondent files are stored. The root cause (CWE-552 - Files or Directories Accessible to Unauthorized Actors) is in ShareApiController.php: when deleteShare() was called, it removed only the Forms-layer share but never invoked shareManager->deleteShare() on the linked Files folder share. The fix in PR #3291 introduces a dedicated removeUploadedFilesShare() helper that queries all Files shares on the form's upload folder and deletes those matching the removed collaborator, and also ensures this cleanup is triggered from the updateShare() path. The CPE cpe:2.3:a:nextcloud:security-advisories is the generic Nextcloud advisory identifier; the specific affected component is the Nextcloud Forms app.

RemediationAI

Upgrade Nextcloud Forms to version 5.2.7, which contains the fix introduced in pull request https://github.com/nextcloud/forms/pull/3291. The patch adds proper cleanup of underlying Files shares when a collaborator with results access is removed. No official workaround is documented by the vendor. As a compensating control for instances that cannot immediately update, administrators can manually audit and revoke Nextcloud Files shares on forms upload folders for any users who have been removed as collaborators - this can be done via the Nextcloud admin share management interface or the occ share:list and share:delete commands. Be aware this is a manual process prone to gaps and should not substitute for patching.