CVE-2026-45157CWE-284

Nextcloud: Valid share tokens allow to access tempory upload files of share owner

Medium · published June 1, 2026

CVSS v3.1
6.3
EPSS
0%
Percentile
31.7
In the wild
Unconfirmed
What it is

Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, when a malicious user has access to a file share of a user, they could use this share token to also access the chunking upload directly and see temporary part files during on going uploads. It is recommended that the Nextcloud Server is upgraded to 32.0.9 or 33.0.3. It is recommended that the Nextcloud Enterprise Server is upgraded to 26.0.13.26, 27.1.11.25, 28.0.14.17, 29.0.16.16, 30.0.17.9, 31.0.14.5, 32.0.9 or 33.0.3

The record
Technical detail
CVSS v3.1
6.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00388 · 31.7th percentile
Weakness
CWE-284 · Improper Access Control
Published
2026-06-01T16:39Z
EPSS history
Timeline
  • 01 JUN 16:39Z
    Nextcloud: Valid share tokens allow to access tempory upload files of share owner
    cvelistv5