Nextcloud Tables CVE-2026-45545

The attacker must hold a valid authenticated Nextcloud account (PR:L) that has been granted access to the Tables app and at least one table or view where column/filter input can be supplied - this is the explicit prerequisite stated in the advisory ('an authenticated attacker with access to the Tables app'). The injection is constrained by a 20-byte length limit on the vulnerable field, and the CVSS AC:H reflects that exploitation requires carefully crafted input that escapes this length restriction rather than a trivially injectable parameter; this raises the skill bar but does not block exploitation. No user interaction is needed from another victim, and the attack is reachable over the network against any Nextcloud instance running a vulnerable Tables app version where the attacker has Tables access.

The CVSS 3.1 score of 8.2 reflects network attack vector (AV:N), high attack complexity (AC:H, consistent with the need to craft input that escapes a 20-byte length cap), low privileges (PR:L, an authenticated Nextcloud user with Tables access), no user interaction, changed scope (S:C - the Tables app boundary into the shared Nextcloud database), and high confidentiality and integrity impact with no availability impact. There is no EPSS score, KEV listing, or known public PoC provided, indicating no evidence of widespread or opportunistic exploitation; the threat profile fits a targeted insider or compromised-credential scenario rather than mass exploitation. The CPE entry points to nextcloud/security-advisories rather than the Tables app package itself, which is a metadata limitation - defenders should treat the affected component as the Nextcloud Tables app and not rely on CPE matching alone for inventory.

An attacker who has obtained a low-privileged Nextcloud account (via phishing, credential reuse, or as a legitimate but malicious internal user) and is permitted to use the Tables app submits a crafted column or filter parameter via the Tables REST API. The payload is designed to break out of the 20-byte length cap and is stored, so when the application later assembles SQL using the value, attacker-controlled SQL executes against the Nextcloud database, allowing exfiltration of other users' data or unauthorized modification of records. No public proof-of-concept is referenced in the advisory.