What is the CVSS score of CVE-2026-45722?

CVE-2026-45722 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L. EPSS exploitation probability: 0.0%.

Which versions of Nextcloud Tables are affected by CVE-2026-45722?

Nextcloud Tables versions 0.9.0-0.9.6 and 1.0.0-1.0.1 contain a SQL injection vulnerability (CVE-2026-45722) that allows authenticated users with Tables app access to extract sensitive data from the…. A patch is available.

How to fix or mitigate CVE-2026-45722?

Within 24 hours: Inventory all Nextcloud Tables deployments and confirm installed versions. Within 7 days: Deploy Nextcloud Tables 0.9.7 (for 0.9.x tracks) or 1.0.2 (for 1.0.x tracks) to all affected instances. Within 30 days: Audit database access logs for suspicious ORDER BY queries or unusual query patterns targeting Nextcloud Tables; document remediation completion.

Nextcloud Tables CVE-2026-45722

EUVD-2026-33719 HIGH

SQL Injection (CWE-89)

2026-06-01 GitHub_M

SQLi Nextcloud Security Advisories

7.1

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L

Primary rating from Vendor (GitHub_M) · only source for this CVE.

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Patch available

Jun 01, 2026 - 20:02 EUVD

Source Code Evidence Fetched

Jun 01, 2026 - 19:22 vuln.today

Analysis Generated

Jun 01, 2026 - 19:22 vuln.today

DescriptionCVE.org

Nextcloud is an open source content collaboration platform. From versions 0.9.0 to before 0.9.7, and 1.0.0 to before 1.0.2, a missing sanitization in the Tables app allowed a user with access to the tables app to perform a limited SQL injection in the ORDER BY statement of a query. Compared to normal SQL injections, the ORDER BY is limited to extracting a single bit of information per request or to make the database wait for a given time. This issue has been patched in versions 0.9.7 and 1.0.2.

AnalysisAI

Blind SQL injection in the Nextcloud Tables app affects versions 0.9.0 through 0.9.6 and 1.0.0 through 1.0.1, allowing authenticated users with access to the Tables app to inject SQL into the ORDER BY clause of database queries. The flaw permits bit-by-bit data extraction or time-based exfiltration against the underlying database, and no public exploit identified at time of analysis. Patches are available in versions 0.9.7 and 1.0.2.

Technical ContextAI

Nextcloud Tables is a first-party app for the Nextcloud collaboration platform that lets users create spreadsheet-like tables backed by the Nextcloud database. The vulnerability is a classic CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) located in lib/Db/Row2Mapper.php, specifically in the addSortQueryForMultipleSleeveFinder method that builds ORDER BY clauses. User-controlled sort mode values were concatenated into the query without validation; the patch in PR #2186 adds an allowlist check (in_array($sortData['mode'], ['ASC', 'DESC'])) and replaces raw createFunction() calls with parameter-safe $qb->func()->max() builder methods. Because ORDER BY injection cannot return rows directly, exploitation is necessarily blind - confined to single-bit extraction via conditional ordering or time-delay primitives.

RemediationAI

Upgrade the Nextcloud Tables app to version 0.9.7 (for the 0.9.x branch) or 1.0.2 (for the 1.0.x branch), both of which contain the fix in PR https://github.com/nextcloud/tables/pull/2186 that adds an ASC/DESC allowlist for sort modes and replaces raw createFunction() string concatenation with parameterized query-builder methods. If immediate upgrade is not possible, restrict access to the Tables app to trusted users only via Nextcloud's app group restrictions (Settings → Apps → Tables → limit to groups) - note that this disables Tables for all other users and is not a substitute for patching. Consult the GHSA advisory at https://github.com/nextcloud/security-advisories/security/advisories/GHSA-5h2w-c7px-hp4j for the authoritative fix guidance.