CVE-2026-45157 describes an improper access control vulnerability (CWE-284) in Nextcloud Server's handling of file shares. Specifically, users with access to a file share can misuse the share token to bypass intended access restrictions and directly access chunked upload data, including temporary partial files that are in the process of being uploaded. This affects Nextcloud Server versions 32.0.0 up to but not including 32.0.9, and 33.0.0 up to but not including 33.0.3. The vulnerability allows unauthorized viewing of upload data, potentially exposing sensitive information.

The vulnerability allows a user with access to a file share to view temporary partial files during chunked uploads, resulting in unauthorized disclosure of data being uploaded. The confidentiality of in-progress uploads is compromised. Integrity and availability impacts are low or none. The CVSS 3.1 base score is 6.3 (medium severity), reflecting network attack vector, low attack complexity, required privileges of a legitimate user, user interaction required, unchanged scope, high confidentiality impact, low integrity impact, and no availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is indicated in the provided data. Until a patch is available, restrict file share access to trusted users only and monitor for suspicious activity related to chunked uploads.