CVE-2026-45810 is an authorization bypass vulnerability in Nextcloud Server affecting versions 31.0.0 to <31.0.12 and 32.0.0 to <32.0.3. The flaw arises from a missing check of a relation, allowing authenticated users who have access to any file comment to read all comments' content. This vulnerability is categorized under CWE-639 (Authorization Bypass Through User-Controlled Key). The vulnerability has a CVSS 3.1 base score of 6.8 (medium severity) with network attack vector, low attack complexity, requiring privileges and user interaction, and impacts confidentiality with no integrity or availability impact. The vendor recommends upgrading to fixed versions 31.0.12 or 32.0.3 for the community server and various specified versions for the Enterprise Server.

The vulnerability allows an authenticated user with access to at least one file comment to read the content of all comments, potentially exposing sensitive or confidential information stored in comments. There is no impact on integrity or availability. The attack requires user privileges and interaction but can be performed remotely over the network.

Upgrading Nextcloud Server to version 31.0.12 or 32.0.3 is recommended to remediate this vulnerability. For Nextcloud Enterprise Server, upgrading to one of the specified fixed versions (21.0.9.20, 22.2.10.35, 23.0.12.31, 24.0.12.30, 25.0.13.25, 26.0.13.22, 27.1.11.22, 28.0.14.13, 29.0.16.10, 30.0.17.5, 31.0.12, or 32.0.3) is advised. Patch status is confirmed by the vendor advisory recommending these upgrades. No additional mitigations are specified.