CVE-2026-45154CWE-284

Nextcloud: Improper Access Control in Collectives

Low · published June 1, 2026

CVSS v3.1
2.6
EPSS
0%
Percentile
22.2
In the wild
Unconfirmed
What it is

Nextcloud is an open source content collaboration platform. From version 2.6.0 to before version 4.3.0, when a previous collective pages was deleted and the collective was shared view-only, guests with access to the collective were able to access the deleted pages directly from the trashbin. This issue has been patched in version 4.3.0.

The record
Technical detail
CVSS v3.1
2.6 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00306 · 22.2th percentile
Weakness
CWE-284 · Improper Access Control
Published
2026-06-01T16:37Z
EPSS history
Timeline
  • 01 JUN 16:37Z
    Nextcloud: Improper Access Control in Collectives
    cvelistv5