CVE-2026-45810 is an authorization bypass vulnerability in Nextcloud Server affecting versions 31.0.0 through 31.0.11 and 32.0.0 through 32.0.2. The issue arises from a missing check of a relation that allows authenticated users who have access to any file comment to read the content of all comments, bypassing intended access controls. The vulnerability is classified under CWE-639 (Authorization Bypass Through User-Controlled Key). Nextcloud recommends upgrading to versions 31.0.12 or 32.0.3 to remediate this issue. Enterprise Server versions with corresponding fixes are also listed.

An authenticated user with access to at least one file comment can read the content of all file comments, potentially exposing sensitive information contained within comments. The vulnerability does not impact integrity or availability but compromises confidentiality of comments. The CVSS score of 6.8 reflects a medium severity impact with network attack vector, low attack complexity, and required privileges with user interaction.

Upgrading Nextcloud Server to version 31.0.12 or 32.0.3 is recommended to remediate this vulnerability. For Nextcloud Enterprise Server, upgrading to one of the specified fixed versions (21.0.9.20, 22.2.10.35, 23.0.12.31, 24.0.12.30, 25.0.13.25, 26.0.13.22, 27.1.11.22, 28.0.14.13, 29.0.16.10, 30.0.17.5, 31.0.12, or 32.0.3) is advised. No official patch or temporary fix details are provided beyond these version upgrades. Patch status is not explicitly confirmed in the advisory text, but the recommended upgrades indicate official fixes are available in those versions.