CVE-2026-45157

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-45157
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-45157.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-45157
Aliases
Published
2026-06-01T16:39:12.214Z
Modified
2026-08-04T11:30:49.426383782Z
Severity
  • 6.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N CVSS Calculator
Summary
Nextcloud: Valid share tokens allow to access tempory upload files of share owner
Details

Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, when a malicious user has access to a file share of a user, they could use this share token to also access the chunking upload directly and see temporary part files during on going uploads. It is recommended that the Nextcloud Server is upgraded to 32.0.9 or 33.0.3. It is recommended that the Nextcloud Enterprise Server is upgraded to 26.0.13.26, 27.1.11.25, 28.0.14.17, 29.0.16.16, 30.0.17.9, 31.0.14.5, 32.0.9 or 33.0.3

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45157.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-284"
    ]
}
References

Affected packages

Git / github.com/nextcloud/server

Affected ranges

Type
GIT
Repo
https://github.com/nextcloud/server
Events
Introduced
5ee29decb00508122f008abacea26fb3e122b13c
Fixed
4671436d69566600853aedaec61cb27966480075
Introduced
72c37934b777f496bf6b9bc12e5d702423a22d8a
Fixed
360808e82fd5af666d51e8ab143d54febe7d8d9e
Database specific 
{
    "extracted_events": [
        {
            "introduced": "32.0.0"
        },
        {
            "fixed": "32.0.9"
        },
        {
            "introduced": "33.0.0"
        },
        {
            "fixed": "33.0.3"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

v32.*
v32.0.0
v32.0.1
v32.0.1rc1
v32.0.1rc2
v32.0.2
v32.0.2rc1
v32.0.2rc2
v32.0.3
v32.0.3rc1
v32.0.3rc2
v32.0.4
v32.0.4rc1
v32.0.5
v32.0.6
v32.0.6rc1
v32.0.7
v32.0.7rc1
v32.0.8
v32.0.8rc1
v32.0.9rc1
v32.0.9rc2
v33.*
v33.0.0
v33.0.1
v33.0.1rc1
v33.0.1rc2
v33.0.2
v33.0.2rc1
v33.0.3rc1
v33.0.3rc2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-45157.json"