CVE-2026-45281 is an authorization bypass vulnerability in Nextcloud Server's calendar backend affecting versions 32.0.0 through 32.0.8 and 33.0.0 through 33.0.2. The flaw allows an authenticated attacker, who knows the principal URL of another user, to bypass authorization controls and gain full access to that user's calendar data, including the ability to view and modify it. This vulnerability is categorized under CWE-639 (Authorization Bypass Through User-Controlled Key).

An attacker with valid authentication and knowledge of another user's principal URL can fully access and modify that user's calendar data. This compromises confidentiality and integrity of calendar information but does not affect availability. The CVSS 3.1 base score is 8.1, indicating high severity with network attack vector, low attack complexity, and no user interaction required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is indicated in the provided data. Users should monitor Nextcloud's official security advisories for updates and apply patches once available. Until then, restrict access to authenticated users and limit exposure of principal URLs if possible.