What is the CVSS score of CVE-2026-45810?

CVE-2026-45810 has a CVSS 3.1 base score of 6.8 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-45810?

Yes, a patch is available for CVE-2026-45810. Update the affected software to the latest version immediately.

Nextcloud Server CVE-2026-45810

EUVD-2026-33720 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-06-01 GitHub_M

Authentication Bypass Nextcloud Security Advisories

6.8

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

6.8 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N

Primary rating from Vendor (GitHub_M) · only source for this CVE.

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Jun 01, 2026 - 20:02 EUVD

Source Code Evidence Fetched

Jun 01, 2026 - 19:29 vuln.today

Analysis Generated

Jun 01, 2026 - 19:29 vuln.today

DescriptionCVE.org

Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 31.0.0 to before 31.0.12, and 32.0.0 to before 32.0.3, a missing check of a relation allowed authenticated users with access to any file comment, to read the content of all comments. It is recommended that the Nextcloud Server is upgraded to 31.0.12 or 32.0.3. It is recommended that the Nextcloud Enterprise Server is upgraded to 21.0.9.20, 22.2.10.35, 23.0.12.31, 24.0.12.30, 25.0.13.25, 26.0.13.22, 27.1.11.22, 28.0.14.13, 29.0.16.10, 30.0.17.5, 31.0.12 or 32.0.3

AnalysisAI

Comment authorization bypass in Nextcloud Server 31.x and 32.x allows authenticated low-privilege users to read all file comments system-wide, bypassing file-level access controls. Affected are Nextcloud Server 31.0.0-31.0.11 and 32.0.0-32.0.2, plus a broad range of Nextcloud Enterprise Server branches. No public exploit has been identified at time of analysis and the vulnerability is absent from CISA KEV, but the CVSS Changed scope rating indicates sensitive organizational data embedded in comments - internal notes, credentials, review feedback - can be exposed cross-user without any file-access permission.

Technical ContextAI

The vulnerability resides in apps/dav/lib/Comments/EntityCollection.php within Nextcloud's WebDAV comments subsystem. The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key), a classic IDOR pattern: when fetching a comment by its numeric ID, the server previously failed to verify that the returned comment's objectType and objectId matched the DAV collection context being traversed. An attacker could supply an arbitrary comment ID while accessing any valid comment endpoint, and the server would return the target comment without validating ownership. The fix adds explicit getObjectType() and getObjectId() boundary checks in both the getId() and childExists() methods of EntityCollection. The same PR also patches QueryBuilder.php and ShardedQueryBuilder.php to sanitize ORDER BY direction parameters to only 'ASC' or 'DESC', closing a separate injection vector in the query layer. The CPE entry cpe:2.3:a:nextcloud:security-advisories covers the advisory scope.

RemediationAI

Vendor-released patch: Nextcloud Server 31.0.12 or 32.0.3 for community editions; Nextcloud Enterprise Server users should upgrade to the patched release for their branch (21.0.9.20, 22.2.10.35, 23.0.12.31, 24.0.12.30, 25.0.13.25, 26.0.13.22, 27.1.11.22, 28.0.14.13, 29.0.16.10, 30.0.17.5, 31.0.12, or 32.0.3). The upstream code fix is available in merged PR https://github.com/nextcloud/server/pull/56982. If immediate patching is not feasible, disabling the Comments app entirely via Admin → Apps → Comments is the most effective compensating control and eliminates the vulnerable DAV endpoint, but removes all comment functionality from the platform. A narrower mitigation is restricting Nextcloud file sharing and comment access to a minimal set of trusted users via admin group policies - this reduces the population of potential exploiters but does not eliminate the vulnerability for authorized users. Neither workaround substitutes for patching. The full vendor security advisory is at https://github.com/nextcloud/security-advisories/security/advisories/GHSA-285v-p9x9-cjhj and the HackerOne disclosure at https://hackerone.com/reports/3425534.