CVE-2026-45283 is an improper authentication vulnerability (CWE-287) affecting the files_lock app in Nextcloud Server. In affected versions, the app does not properly validate file ownership when handling DAV lock and unlock requests, allowing authenticated users to manipulate locks on files belonging to others via absolute WebDAV paths. Furthermore, lock tokens are disclosed in error responses to unauthorized callers, facilitating the removal of locks placed by other users' client applications. The vulnerability affects Nextcloud Server versions from 32.0.0 up to but not including 32.0.2, and 33.0.0 up to but not including 33.0.1. The CVSS v3.1 base score is 6.3, indicating a medium severity level.

An authenticated user can bypass proper ownership checks to lock or unlock files belonging to other users, potentially disrupting file access controls. Disclosure of lock tokens in error messages further enables unauthorized removal of locks, which may affect data integrity and collaboration workflows. The impact includes limited confidentiality, integrity, and availability consequences as indicated by the CVSS vector (C:L/I:L/A:L).

Upgrading Nextcloud Server to version 32.0.2 or 33.0.1, or Nextcloud Enterprise Server to version 31.0.14.4, 32.0.2, or 33.0.1 is recommended to remediate this vulnerability. Patch status is not explicitly confirmed in the advisory, but the vendor recommends these upgrades as fixes. No alternative mitigations or temporary workarounds are provided.