CVE-2026-45282: CWE-284: Improper Access Control in nextcloud security-advisories
Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, an authenticated attacker can access attachments of link shares when knowing the share token, circumventing password protection or download restrictions. It is applicable to any file that is shared directly, as the attacker only needs to know a documentId they own, apart of the mentioned share token. For shared folders the attacker has to know or guess a documentId of a file that is included inside the folder, making it much harder to exploit. The attacker can only extract an attachments, but not the file shared file or folder itself. It is recommended that the Nextcloud Server is upgraded to 33.0.3 or 32.0.9. It is recommended that the Nextcloud Enterprise Server is upgraded to 33.0.3, 32.0.9, 31.0.14.5, 30.0.17.9, 29.0.16.16, 28.0.14.17 or 27.1.11.5
AI Analysis
Technical Summary
Nextcloud Server versions 32.0.0 through 32.0.8 and 33.0.0 through 33.0.2 contain an improper access control vulnerability (CWE-284) identified as CVE-2026-45282. This vulnerability allows an authenticated attacker who knows the share token of a link share to access attachments associated with that share, circumventing password protection and download restrictions. The attacker requires knowledge of a documentId they own for directly shared files or must guess a documentId within a shared folder to exploit the vulnerability. The attacker cannot access the shared file or folder itself, only the attachments. The vulnerability has a CVSS 3.1 base score of 6.5 (medium severity) with network attack vector, low attack complexity, and no user interaction required. Nextcloud recommends upgrading to fixed versions 33.0.3 or 32.0.9 for the Server and specified versions for the Enterprise Server to remediate this issue.
Potential Impact
An authenticated attacker with knowledge of a share token can bypass password protection and download restrictions to access attachments of link shares. This compromises confidentiality of attachments but does not allow access to the shared files or folders themselves. The impact is limited to attachment exposure and requires authentication and knowledge or guessing of documentIds. There are no known exploits in the wild at this time.
Mitigation Recommendations
Nextcloud recommends upgrading affected Server versions to 33.0.3 or 32.0.9 and Enterprise Server versions to 33.0.3, 32.0.9, 31.0.14.5, 30.0.17.9, 29.0.16.16, 28.0.14.17, or 27.1.11.5. No official patch or temporary workaround details are provided beyond upgrading. Patch status is not explicitly confirmed in the advisory, but the upgrade recommendation indicates that fixed versions are available. Users should apply these updates to remediate the vulnerability.
CVE-2026-45282: CWE-284: Improper Access Control in nextcloud security-advisories
Description
Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, an authenticated attacker can access attachments of link shares when knowing the share token, circumventing password protection or download restrictions. It is applicable to any file that is shared directly, as the attacker only needs to know a documentId they own, apart of the mentioned share token. For shared folders the attacker has to know or guess a documentId of a file that is included inside the folder, making it much harder to exploit. The attacker can only extract an attachments, but not the file shared file or folder itself. It is recommended that the Nextcloud Server is upgraded to 33.0.3 or 32.0.9. It is recommended that the Nextcloud Enterprise Server is upgraded to 33.0.3, 32.0.9, 31.0.14.5, 30.0.17.9, 29.0.16.16, 28.0.14.17 or 27.1.11.5
CVSS v3.1
Score 6.5medium
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Nextcloud Server versions 32.0.0 through 32.0.8 and 33.0.0 through 33.0.2 contain an improper access control vulnerability (CWE-284) identified as CVE-2026-45282. This vulnerability allows an authenticated attacker who knows the share token of a link share to access attachments associated with that share, circumventing password protection and download restrictions. The attacker requires knowledge of a documentId they own for directly shared files or must guess a documentId within a shared folder to exploit the vulnerability. The attacker cannot access the shared file or folder itself, only the attachments. The vulnerability has a CVSS 3.1 base score of 6.5 (medium severity) with network attack vector, low attack complexity, and no user interaction required. Nextcloud recommends upgrading to fixed versions 33.0.3 or 32.0.9 for the Server and specified versions for the Enterprise Server to remediate this issue.
Potential Impact
An authenticated attacker with knowledge of a share token can bypass password protection and download restrictions to access attachments of link shares. This compromises confidentiality of attachments but does not allow access to the shared files or folders themselves. The impact is limited to attachment exposure and requires authentication and knowledge or guessing of documentIds. There are no known exploits in the wild at this time.
Mitigation Recommendations
Nextcloud recommends upgrading affected Server versions to 33.0.3 or 32.0.9 and Enterprise Server versions to 33.0.3, 32.0.9, 31.0.14.5, 30.0.17.9, 29.0.16.16, 28.0.14.17, or 27.1.11.5. No official patch or temporary workaround details are provided beyond upgrading. Patch status is not explicitly confirmed in the advisory, but the upgrade recommendation indicates that fixed versions are available. Users should apply these updates to remediate the vulnerability.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-05-11T18:41:13.157Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a1de306e29bf47b503a5576
Added to database: 6/1/2026, 7:52:38 PM
Last enriched: 6/1/2026, 8:05:18 PM
Last updated: 6/2/2026, 5:06:10 AM
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.