VulnerabilityAnalyzed

CVE-2026-45286

Nextcloud is an open source content collaboration platform.

MEDIUM 4.3EPSS 0.28%

Does this matter?

Lower severity and a low EPSS score (0.28%). Track it; it rarely justifies an emergency change on its own.

Description

Nextcloud is an open source content collaboration platform. From versions 5.5.13 to before 5.5.17, and 6.2.0 to before 6.2.3, an authenticated user can enumerate users on the same Nextcloud instance by using the Calendar app's endpoint for suggesting attendees. The sharing restrictions, applied to other endpoints, were not effective here. This issue has been patched in versions 5.5.17 and 6.2.3.

CVSS 3.1: 4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
EPSS: 0.28% probability · 21th percentile
CISA KEV: Not listed
Weakness: CWE-200
Affected: nextcloud/calendar
Source: security-advisories@github.com

References

https://github.com/nextcloud/calendar/issues/7971Exploit, Issue Tracking, Patch
https://github.com/nextcloud/calendar/pull/8197Issue Tracking, Patch
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-r697-74m9-gvf2Mitigation, Vendor Advisory
https://hackerone.com/reports/3540663Permissions Required

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.