CVE-2026-45155 is an authorization bypass vulnerability in Nextcloud Server's circle management API. The vulnerability arises from a missing access control check that permits adding unknown circles by their ID to other circles. Although the default circle ID complexity is high, reducing the likelihood of arbitrary exploitation, if an attacker obtains a valid circle ID through other means, they could track memberships by adding circles improperly. This affects Nextcloud Server versions 32.0.0 up to but not including 32.0.7 and 33.0.0 up to but not including 33.0.1. The issue is addressed by upgrading to 32.0.7 or 33.0.1, or the corresponding Enterprise Server versions.

The vulnerability allows an attacker with limited privileges and user interaction to bypass authorization controls at the API level, potentially enabling them to add unknown circles to other circles. This could lead to unauthorized tracking of circle memberships. The impact on confidentiality is low, with no integrity or availability impact reported. The CVSS score of 2.6 reflects a low-severity issue requiring user interaction and high attack complexity.

Upgrading Nextcloud Server to version 32.0.7 or 33.0.1 is recommended to remediate this vulnerability. For Nextcloud Enterprise Server, upgrade to versions 29.0.16.14, 30.0.17.8, 31.0.14.3, 32.0.7, or 33.0.1. No other mitigation or temporary workaround is indicated. Patch status is not explicitly stated but the vendor advisory recommends upgrading to these fixed versions.