CVE-2026-45283 is an improper authentication vulnerability (CWE-287) affecting Nextcloud Server's files_lock app in versions 32.0.0 to before 32.0.2 and 33.0.0 to before 33.0.1. The vulnerability arises from insufficient validation of file ownership when processing WebDAV lock and unlock requests, enabling authenticated users to manipulate locks on files owned by others. Furthermore, lock tokens were disclosed in error responses to unauthorized callers, facilitating removal of token-based locks by attackers. The vulnerability has a CVSS 3.1 base score of 6.3 (medium severity) with network attack vector, low attack complexity, and requires privileges but no user interaction. The vendor recommends upgrading to fixed versions 32.0.2 or 33.0.1 for Nextcloud Server and 31.0.14.4 or later for Nextcloud Enterprise Server.

An authenticated user can improperly lock or unlock files owned by other users, potentially disrupting file access controls. Disclosure of lock tokens in error responses may allow attackers to remove locks placed by other users' client applications, undermining file locking mechanisms. This could lead to unauthorized modification or denial of access to files within the Nextcloud environment.

Upgrading Nextcloud Server to version 32.0.2 or 33.0.1, or Nextcloud Enterprise Server to version 31.0.14.4 or later, is recommended to remediate this vulnerability. Patch status is not explicitly stated but the vendor advisory recommends these upgrades as fixes. There is no indication that the vulnerability is mitigated without applying these updates. No additional mitigation steps are specified.