What is the CVSS score of EUVD-2026-33679?

EUVD-2026-33679 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for EUVD-2026-33679?

Yes, a patch is available for EUVD-2026-33679. Update the affected software to the latest version immediately.

Nextcloud Forms EUVD-2026-33679

| CVE-2026-45267 MEDIUM

Information Exposure (CWE-200)

2026-06-01 GitHub_M

Information Disclosure Nextcloud

6.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Jun 01, 2026 - 18:01 EUVD

Source Code Evidence Fetched

Jun 01, 2026 - 17:22 vuln.today

Analysis Generated

Jun 01, 2026 - 17:22 vuln.today

DescriptionGitHub Advisory

Nextcloud is an open source content collaboration platform. Prior to version 5.2.6, a missing permissions check allowed users to request reading form submissions of other users. This issue has been patched in version 5.2.6.

AnalysisAI

Unauthorized access to form submissions in Nextcloud Forms prior to version 5.2.6 allows any authenticated user to read survey or form responses submitted by other users. The root cause is a missing authorization check in the getSubmission API endpoint (ApiController.php), which failed to verify whether the requesting user held the PERMISSION_RESULTS privilege or was the original submitter. With a CVSS score of 6.5 (Medium) and no public exploit identified at time of analysis, real-world risk is bounded by the requirement for an authenticated session, but the confidentiality impact is rated High given unrestricted access to potentially sensitive form response data.

Technical ContextAI

Nextcloud Forms is a first-party Nextcloud application enabling users to create and distribute surveys and forms. The vulnerability resides in lib/Controller/ApiController.php within the getSubmission method. Prior to the fix, this REST API endpoint returned submission data for any provided formId and submissionId without verifying that the requesting user either (a) held the PERMISSION_RESULTS privilege for the form, or (b) was the user who originally created the submission. The patch (PR #3269) introduces a call to formsService->getPermissions($form) and checks in_array(Constants::PERMISSION_RESULTS, $permissions) before evaluating $submission['userId'] !== $this->currentUser->getUID(), throwing an OCSForbiddenException if neither condition is satisfied. CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) accurately describes the root cause class - data is returned to a caller that lacks the authorization to access it. The CPE cpe:2.3:a:nextcloud:security-advisories:*:*:*:*:*:*:*:* is the NVD-assigned identifier tied to Nextcloud's security advisory program rather than the Forms app component specifically.

RemediationAI

Vendor-released patch: Nextcloud Forms 5.2.6. Administrators should upgrade the Nextcloud Forms app to version 5.2.6 or later via the Nextcloud App Store or by applying the upstream fix from PR #3269 (https://github.com/nextcloud/forms/pull/3269). The vendor security advisory is available at https://github.com/nextcloud/security-advisories/security/advisories/GHSA-r4gh-f8x6-m55f. If an immediate upgrade is not feasible, a compensating control is to disable the Nextcloud Forms application entirely from the Nextcloud admin panel under Apps - this eliminates the vulnerable API surface but also removes all form functionality for users. Restricting network access to the Nextcloud API endpoint at the reverse-proxy or firewall level is not a viable workaround because the vulnerability requires only a low-privilege authenticated session, not unauthenticated access, and legitimate users need API access to use the platform.