What is the CVSS score of CVE-2026-45545?

CVE-2026-45545 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Nextcloud Tables are affected by CVE-2026-45545?

Nextcloud Tables app contains a SQL injection vulnerability (CVE-2026-45545) that allows authenticated users to execute arbitrary database queries, potentially enabling unauthorized data extraction…. A patch is available.

How to fix or mitigate CVE-2026-45545?

24 HOURS: Identify all users with Nextcloud Tables feature access and review their privilege levels; assess data sensitivity in affected databases. 7 DAYS: Restrict Tables access to essential personnel only; implement enhanced monitoring of database query activity; audit recent access logs for suspicious patterns. 30 DAYS: Monitor Nextcloud security advisories for patch release; maintain deployment readiness to patch immediately upon vendor release.

Nextcloud Tables CVE-2026-45545

EUVD-2026-33715 HIGH

SQL Injection (CWE-89)

2026-06-01 GitHub_M

SQLi Nextcloud Security Advisories

8.2

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.2 HIGH

AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N

Primary rating from Vendor (GitHub_M) · only source for this CVE.

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Patch available

Jun 01, 2026 - 20:02 EUVD

Source Code Evidence Fetched

Jun 01, 2026 - 19:23 vuln.today

Analysis Generated

Jun 01, 2026 - 19:23 vuln.today

DescriptionCVE.org

Nextcloud is an open source content collaboration platform. From versions 0.7.0 to before 0.7.7, 0.8.0 to before 0.8.10, 0.9.0 to before 0.9.8, and 1.0.0 to before 1.0.4, an authenticated attacker with access to the Tables app may be able to execute arbitrary up to 20 bytes long SQL queries, through a stored injection. With carefully crafted input it is possible to break out of the length limitation. The attacker could use this to extract information from the database, or modify data. This issue has been patched in versions 0.7.7, 0.8.10, 0.9.8, 1.0.4, and 2.0.0.

AnalysisAI

SQL injection in the Nextcloud Tables app allows authenticated users with access to the Tables feature to execute arbitrary SQL queries against the backend database via a stored injection vector. Although a 20-byte length limit is imposed on the injected payload, carefully crafted input can break out of this restriction, enabling data extraction and modification. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Technical ContextAI

Nextcloud Tables is a first-party app for the Nextcloud content collaboration platform that lets users create and manage tabular data structures with typed columns, filters, and views. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), where user-supplied values flowing through the Tables app's view/column update API paths (notably column type and filter operator parameters in Api1Controller) were not constrained to a strict allow-list before being incorporated into database queries. The patch in PR nextcloud/tables#2309 introduces PHP backed enums (ColumnType, FilterOperator, ViewUpdatableParameters) and a typed ViewUpdateInput model so that values such as column type and filter operator can only be one of a small predefined set, with ValueError exceptions returning HTTP 400 on invalid input - eliminating the path by which attacker-controlled fragments reached SQL.

RemediationAI

Upgrade the Nextcloud Tables app to a vendor-released patched version: 0.7.7, 0.8.10, 0.9.8, 1.0.4, or 2.0.0, as confirmed in advisory GHSA-x43f-gmgh-vvjj (https://github.com/nextcloud/security-advisories/security/advisories/GHSA-x43f-gmgh-vvjj) with the corresponding upstream fix in pull request https://github.com/nextcloud/tables/pull/2309. As compensating controls until upgrade, restrict the Tables app to a minimal trusted user set via Nextcloud's app and group access settings, or disable the Tables app entirely from the Apps administration page if it is not in active use - accepting that disabling will remove tabular data functionality and may break workflows depending on it. Reviewing database and Nextcloud audit logs for unexpected queries from Tables-app database users is recommended given the stored nature of the injection.