CVE-2026-45285 is a missing authorization vulnerability (CWE-862) in Nextcloud's sharing functionality affecting versions 32.0.0 to before 32.0.9 and 33.0.0 to before 33.0.3. When a folder or file is shared with a Nextcloud Team including an external member (added via email without a Nextcloud account), the system automatically generates a public link for that external member. This link is not displayed in the folder's share section, so the folder owner is unaware of its existence. The link is emailed to the external member and grants the same permissions as the Team's access, enabling full control over the shared content without further authentication. The vulnerability has been addressed in Nextcloud versions 32.0.9 and 33.0.3.

An attacker who obtains or intercepts the undisclosed public link can access, modify, delete, reshare, and download all data in the shared folder without any additional authentication. The folder owner cannot detect or revoke this link via the standard sharing interface, leading to unauthorized data exposure and potential data loss or manipulation. The CVSS 3.1 base score is 6.4 (medium severity), reflecting network attack vector, high complexity, low privileges required, user interaction needed, and high confidentiality and integrity impact with no availability impact.

This vulnerability has been patched in Nextcloud versions 32.0.9 and 33.0.3. Users should upgrade to these or later versions to remediate the issue. There is no indication of a temporary workaround or alternative mitigation. Patch status is confirmed by the vendor advisory stating the fix is included in these versions.