What is the CVSS score of EUVD-2026-33677?

EUVD-2026-33677 has a CVSS 3.1 base score of 3.5 (Low). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for EUVD-2026-33677?

Yes, a patch is available for EUVD-2026-33677. Update the affected software to the latest version immediately.

Nextcloud E2EE App EUVD-2026-33677

| CVE-2026-45159 LOW

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-06-01 GitHub_M

Authentication Bypass Nextcloud

3.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

3.5 LOW

AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Patch available

Jun 01, 2026 - 18:01 EUVD

Source Code Evidence Fetched

Jun 01, 2026 - 17:21 vuln.today

Analysis Generated

Jun 01, 2026 - 17:21 vuln.today

DescriptionGitHub Advisory

Nextcloud is an open source content collaboration platform. From versions 1.15.0 to before 1.15.4, 1.16.0 to before 1.16.3, 1.17.0 to before 1.17.1, and 1.18.0 to before 1.18.1, a malicious user with access to an end-to-end encrypted files drop link was able to also drop files into other end-to-end encrypted folders of the share owner. Reading and modifying of other files was not possible. This issue has been patched in versions 1.15.4, 1.16.3, 1.17.1, 1.18.1, and 2.0.0-rc.7.

AnalysisAI

Unauthorized file injection in the Nextcloud end-to-end encryption application (versions 1.15.0-1.18.x) allows a low-privileged user possessing a valid E2EE files drop share link to write files into other E2EE-encrypted folders owned by the same share owner. The impact is strictly integrity-limited - confidentiality is unaffected and existing files cannot be read or modified - consistent with the CVSS score of 3.5 (Low). No public exploit has been identified and this vulnerability is not listed in the CISA KEV catalog; it was responsibly disclosed via HackerOne report #3304830.

Technical ContextAI

The vulnerability resides in MetaDataController.php within Nextcloud's end_to_end_encryption application. The root cause, CWE-639 (Authorization Bypass Through User-Controlled Key), stems from the original getOwnerId() method resolving share ownership solely from a shareToken without verifying that the caller-supplied fileId parameter fell within the scope of that share. A valid file drop token - which should only authorize writes to its specifically shared E2EE folder - could therefore be submitted alongside an arbitrary fileId referencing a different E2EE folder owned by the same user, bypassing the intended folder scope boundary. The fix introduced in PR #1395 replaces getOwnerId() with getFileDropOwnerId(), which enforces four explicit guards: (1) the share must carry CREATE permission, (2) the share root must be a Folder node, (3) that folder must be encrypted, and (4) the requested fileId must equal the share root or be a descendant node returned by getFirstNodeById() - preventing any out-of-scope folder targeting. Affected CPE: cpe:2.3:a:nextcloud:security-advisories:*:*:*:*:*:*:*:*.

RemediationAI

Upgrade the Nextcloud end-to-end encryption app to the vendor-released patched versions: 1.15.4, 1.16.3, 1.17.1, 1.18.1, or 2.0.0-rc.7, selecting the branch that corresponds to your current deployment. The upstream source fix is documented in PR #1395 at https://github.com/nextcloud/end_to_end_encryption/pull/1395 and the full vendor advisory is at https://github.com/nextcloud/security-advisories/security/advisories/GHSA-p3qw-7gwx-wg24. If immediate patching is not feasible, a targeted compensating control is to disable or revoke all end-to-end encrypted files drop shares (i.e., create-only share links targeting E2EE folders) until the patch is applied - this eliminates the attack vector entirely since the exploit requires a valid drop link as its entry point. The trade-off is that external collaborators lose the ability to submit files via drop links until patching is complete.