CVE-2026-45810: Nextcloud: Propfind requests for file comments allowed to load comments for other files
Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 31.0.0 to before 31.0.12, and 32.0.0 to before 32.0.3, a missing check of a relation allowed authenticated users with access to any file comment, to read the content of all comments. It is recommended that the Nextcloud Server is upgraded to 31.0.12 or 32.0.3. It is recommended that the Nextcloud Enterprise Server is upgraded to 21.0.9.20, 22.2.10.35, 23.0.12.31, 24.0.12.30, 25.0.13.25, 26.0.13.22, 27.1.11.22, 28.0.14.13, 29.0.16.10, 30.0.17.5, 31.0.12 or 32.0.3
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2026-45810?
CVE-2026-45810 has a medium severity rating of 6.8.
How do I fix CVE-2026-45810?
To fix CVE-2026-45810, upgrade your Nextcloud server to version 31.0.12 or 32.0.3 or later.
What types of users are affected by CVE-2026-45810?
Authenticated users with access to any file comment can be affected by CVE-2026-45810.
What kind of data is exposed in CVE-2026-45810?
CVE-2026-45810 allows users to read the content of all file comments, not just those they own.
Which versions of Nextcloud are impacted by CVE-2026-45810?
CVE-2026-45810 affects Nextcloud Server versions from 31.0.0 to before 31.0.12, and 32.0.0 to before 32.0.3.