CVE-2026-45810: Nextcloud: Propfind requests for file comments allowed to load comments for other files
Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 31.0.0 to before 31.0.12, and 32.0.0 to before 32.0.3, a missing check of a relation allowed authenticated users with access to any file comment, to read the content of all comments. It is recommended that the Nextcloud Server is upgraded to 31.0.12 or 32.0.3. It is recommended that the Nextcloud Enterprise Server is upgraded to 21.0.9.20, 22.2.10.35, 23.0.12.31, 24.0.12.30, 25.0.13.25, 26.0.13.22, 27.1.11.22, 28.0.14.13, 29.0.16.10, 30.0.17.5, 31.0.12 or 32.0.3
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Nextcloud Serverto a version that resolves this vulnerability.Fixed in 31.0.12 - Upgrade
Upgrade
Nextcloud Serverto a version that resolves this vulnerability.Fixed in 32.0.3 - Upgrade
Upgrade
Nextcloud Enterprise Serverto a version that resolves this vulnerability.Fixed in 21.0.9.20 - Upgrade
Upgrade
Nextcloud Enterprise Serverto a version that resolves this vulnerability.Fixed in 22.2.10.35 - Upgrade
Upgrade
Nextcloud Enterprise Serverto a version that resolves this vulnerability.Fixed in 23.0.12.31 - Upgrade
Upgrade
Nextcloud Enterprise Serverto a version that resolves this vulnerability.Fixed in 24.0.12.30 - Upgrade
Upgrade
Nextcloud Enterprise Serverto a version that resolves this vulnerability.Fixed in 25.0.13.25 - Upgrade
Upgrade
Nextcloud Enterprise Serverto a version that resolves this vulnerability.Fixed in 26.0.13.22 - Upgrade
Upgrade
Nextcloud Enterprise Serverto a version that resolves this vulnerability.Fixed in 27.1.11.22 - Upgrade
Upgrade
Nextcloud Enterprise Serverto a version that resolves this vulnerability.Fixed in 28.0.14.13 - Upgrade
Upgrade
Nextcloud Enterprise Serverto a version that resolves this vulnerability.Fixed in 29.0.16.10 - Upgrade
Upgrade
Nextcloud Enterprise Serverto a version that resolves this vulnerability.Fixed in 30.0.17.5
Event History
Frequently Asked Questions
What is the severity of CVE-2026-45810?
CVE-2026-45810 has a medium severity rating of 6.8.
How do I fix CVE-2026-45810?
To fix CVE-2026-45810, upgrade your Nextcloud server to version 31.0.12 or 32.0.3 or later.
What types of users are affected by CVE-2026-45810?
Authenticated users with access to any file comment can be affected by CVE-2026-45810.
What kind of data is exposed in CVE-2026-45810?
CVE-2026-45810 allows users to read the content of all file comments, not just those they own.
Which versions of Nextcloud are impacted by CVE-2026-45810?
CVE-2026-45810 affects Nextcloud Server versions from 31.0.0 to before 31.0.12, and 32.0.0 to before 32.0.3.