CVE-2026-45159 is an authorization bypass vulnerability in Nextcloud's end-to-end encrypted file sharing feature affecting multiple versions prior to 1.15.4, 1.16.3, 1.17.1, and 1.18.1. The flaw allows a malicious user with access to a files drop link to place files into other encrypted folders of the share owner without permission. The vulnerability does not permit reading or modifying existing files. The issue is tracked under CWE-639 (Authorization Bypass Through User-Controlled Key) and has a CVSS 3.1 base score of 3.5, indicating low severity. Official patches addressing this vulnerability have been released in the specified fixed versions.

An attacker with limited privileges and access to an end-to-end encrypted files drop link can inject files into other encrypted folders of the share owner. This could potentially lead to confusion or misuse of the victim's encrypted storage but does not allow the attacker to read or alter existing files. The impact is limited to unauthorized file addition only, with no confidentiality or availability compromise reported.

This vulnerability has been patched in Nextcloud versions 1.15.4, 1.16.3, 1.17.1, 1.18.1, and 2.0.0-rc.7. Users should upgrade to one of these fixed versions to remediate the issue. Since the vendor advisory confirms patches are available, upgrading is the recommended and effective mitigation.