CVE-2026-45722 is a SQL injection vulnerability in the Nextcloud Tables app affecting versions 0.9.0 to before 0.9.7 and 1.0.0 to before 1.0.2. The issue arises from improper neutralization of special elements in the ORDER BY clause of SQL queries, allowing an attacker with access to the Tables app to perform limited SQL injection. This injection is constrained to extracting a single bit of information per request or causing time delays in the database response. The vulnerability has been addressed by patches in versions 0.9.7 and 1.0.2. The CVSS 3.1 score of 7.1 reflects a high severity with network attack vector, low attack complexity, requiring low privileges but no user interaction, and impacts confidentiality and availability.

The vulnerability allows an attacker with access to the Tables app to perform limited SQL injection attacks that can leak small amounts of data (one bit per request) or cause the database to delay responses, impacting confidentiality and availability. There is no indication of integrity impact. No known exploits in the wild have been reported.

Upgrade Nextcloud Tables app to version 0.9.7 or later, or 1.0.2 or later, where the vulnerability has been patched. Patch status is not explicitly confirmed beyond these fixed versions, so applying these updates is the recommended remediation.