CVE-2026-45543CWE-552

Nextcloud: Deleting a Forms collaborator share leaves uploaded response files accessible through a lingering Files share

Medium · published June 1, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
39.0
In the wild
Unconfirmed
What it is

Nextcloud is an open source content collaboration platform. From version 4.3.0 to before version 5.2.7, a removed collaborator retains unauthorized read access to uploaded respondent files for the affected form. The scope is limited to uploaded files for forms where that user previously had results access. This issue has been patched in version 5.2.7.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00461 · 39.0th percentile
Weakness
CWE-552 · Files or Directories Accessible to External Parties
Published
2026-06-01T17:00Z
EPSS history
Timeline
  • 01 JUN 17:00Z
    Nextcloud: Deleting a Forms collaborator share leaves uploaded response files accessible through a lingering Files share
    cvelistv5