CVE-2026-45286
Nextcloud is an open source content collaboration platform.
Does this matter?
Lower severity and a low EPSS score (0.28%). Track it; it rarely justifies an emergency change on its own.
Description
Nextcloud is an open source content collaboration platform. From versions 5.5.13 to before 5.5.17, and 6.2.0 to before 6.2.3, an authenticated user can enumerate users on the same Nextcloud instance by using the Calendar app's endpoint for suggesting attendees. The sharing restrictions, applied to other endpoints, were not effective here. This issue has been patched in versions 5.5.17 and 6.2.3.
- CVSS 3.1
- 4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- EPSS
- 0.28% probability · 20th percentile
- Public exploits
- None in Exploit-DB
- CISA KEV
- Not listed
- Weakness
- CWE-200
- Affected
- nextcloud/calendar
- Source
- security-advisories@github.com
EPSS 0.3% since 26 October 2026; no change recorded yet. Points are recorded when the score first appears and whenever it moves by a percentage point or more.
References
- https://github.com/nextcloud/calendar/issues/7971Exploit, Issue Tracking, Patch
- https://github.com/nextcloud/calendar/pull/8197Issue Tracking, Patch
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-r697-74m9-gvf2Mitigation, Vendor Advisory
- https://hackerone.com/reports/3540663Permissions Required
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.