CVE-2026-45155

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-45155

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-45155.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-45155

Aliases

GHSA-xpgv-grf9-gm7x

Published

2026-06-01T16:38:33.335Z

Modified

2026-07-15T01:49:17.959372847Z

Severity

2.6 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N CVSS Calculator

Summary

Nextcloud: Private circle can be added to another circle via API

Details

Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.7 and 33.0.0 to before 33.0.1, a missing access check on API level allowed to add unknown circles by their ID directly to other circles. Since circle IDs have 62^15 complexity by default this is still unlikely to be executable at will, but if access to an ID was available via another source, memberships could be tracked like this. It is recommended that the Nextcloud Server is upgraded to 32.0.7 or 33.0.1. It is recommended that the Nextcloud Enterprise Server is upgraded to 29.0.16.14, 30.0.17.8, 31.0.14.3, 32.0.7 or 33.0.1

Database specific

{
    "cwe_ids": [
        "CWE-639"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45155.json",
    "cna_assigner": "GitHub_M"
}

References

Affected packages

Git / github.com/nextcloud/circles

Affected ranges

Type

GIT

Repo

https://github.com/nextcloud/circles

Events

Introduced

d5cbcb1f9b76f37dfcc028298c2070304eb197ef

Fixed

27fe0df6cfdd5693a13ce6b6517dd9c7b6cbec47

Introduced

c691b7e0ba8d12376499a0fb155bc7a3e2e62332

Fixed

f7476931db2c43138ea264ec27275cfe50f90061

Database specific

{
    "extracted_events": [
        {
            "introduced": "32.0.0"
        },
        {
            "fixed": "32.0.7"
        },
        {
            "introduced": "33.0.0"
        },
        {
            "fixed": "33.0.1"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

v32.*

v32.0.0

v32.0.1

v32.0.1rc1

v32.0.1rc2

v32.0.2

v32.0.2rc1

v32.0.2rc2

v32.0.3

v32.0.3rc1

v32.0.3rc2

v32.0.4

v32.0.4rc1

v32.0.5

v32.0.6

v32.0.6rc1

v32.0.7rc1

v33.*

v33.0.0

v33.0.1rc1

v33.0.1rc2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-45155.json"