Nextcloud

Don't miss out!

Thousands of developers use stack.watch to stay informed.
Get an email whenever new security vulnerabilities are reported in any Nextcloud product.

RSS Feeds for Nextcloud security vulnerabilities

Create a CVE RSS feed including security vulnerabilities found in Nextcloud products with stack.watch. Just hit watch, then grab your custom RSS feed url.

Products by Nextcloud Sorted by Most Security Vulnerabilities since 2018

Nextcloud Server152 vulnerabilities

Nextcloud129 vulnerabilities

Nextcloud Desktop23 vulnerabilities

Nextcloud Talk20 vulnerabilities

Nextcloud Deck18 vulnerabilities

Nextcloud Server15 vulnerabilities

Nextcloud Mail13 vulnerabilities

Nextcloud Richdocuments9 vulnerabilities

Nextcloud Mail8 vulnerabilities

Nextcloud Contacts7 vulnerabilities

Nextcloud User Oidc7 vulnerabilities

Nextcloud Calendar6 vulnerabilities

Nextcloud Guests2 vulnerabilities

Nextcloud Notes2 vulnerabilities

Nextcloud Sso Saml Authentication1 vulnerability

Nextcloud Zipper1 vulnerability

Nextcloudpi1 vulnerability

Nextcloud Global Site Selector1 vulnerability

By the Year

In 2026 there have been 47 vulnerabilities in Nextcloud with an average score of 5.6 out of ten. Last year, in 2025 Nextcloud had 25 security vulnerabilities published. That is, 22 more vulnerabilities have already been reported in 2026 as compared to last year. However, the average CVE base score of the vulnerabilities in 2026 is greater by 1.31.

Year	Vulnerabilities	Average Score
2026	47	5.64
2025	25	4.33
2024	35	5.84
2023	80	6.31
2022	51	5.13
2021	63	6.21
2020	50	5.05
2019	9	6.33
2018	13	5.72

It may take a day or so for new Nextcloud vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.

Recent Nextcloud Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2026-87897	Oct 27, 2026	SSRF Enables Chrome DevTools API JWT Leaks for Whiteboard A SSRF vulnerability found that enables access to internal Chrome Devtools Protocol APIs that can leak the JWT authentication token for another user. A low privileged attacker could continually exploit this vulnerability to leak the JWT authentication token for another user when they start a recording, which then enables the attacker read/write access to the victim's Whiteboard.
CVE-2026-82986	Oct 27, 2026	TableShare: User Bypass Admin-Set GR on Table Link Sharing The user in a group can bypass the group restriction set by an administrator on link sharing, creating share links for a table even though they shouldn't have that permission.
CVE-2026-82984	Oct 27, 2026	Auth Bypass: Enumerate Team Resources via API Even When Team Visible to Everyone When a team was configured as "visible to everyone", the web UI correctly blocked non-members from viewing the team ("You are not a member of ..."), but the resources API endpoint could still be called directly, allowing any authenticated non-member to enumerate the team's internal resources and their identifiers. This does not grant access to the contents of the discovered resources themselves, only their existence, names, and identifiers.	Server
CVE-2026-82983	Oct 27, 2026	Tables App: Share-Listing GET Endpoint Exposes Recipients Without Manage Check The Tables app's share-listing endpoint (GET /apps/tables/share/table/{tableId}) did not verify that the requesting user has manage-level permission on the table before returning the full list of share recipients (users, groups, and teams) along with their permission levels. A user who was only granted read-data access to a table, and who is correctly prevented from seeing this information in the web UI, could call the endpoint directly to enumerate everyone the table is shared with and their access levels. This does not expose the table's data itself beyond what the read-data grant already permits, only the list of share recipients and their permission levels.
CVE-2026-77173	Oct 27, 2026	Confidentiality Bypass via Filename # in DOCX/ODT Upload A user could create a docx or odt file with a # in the filename with confidential information such as a credit card number and have it not be marked as confidential.
CVE-2026-77172	Oct 27, 2026	App Passwords Bypass Password Confirmation on Sensitive Endpoints App passwords were allowed to bypass password confirmation on sensitive endpoints.	Server
CVE-2026-77171	Oct 27, 2026	CVE-2026-77171 Public Shared Collective Link Allows Unauthorized Page Creation A public shared collective always allowed recipients of the link to create pages.
CVE-2026-77167	Oct 27, 2026	Nextcloud Federated Share Endpoint Write RCE via oc_share_external Table Abusing the federated share endpoint, an attacker can write arbitrary rows into the oc_share_external database table. These rows persist indefinitely there is no automatic cleanup mechanism. Three distinct denial-of-service conditions follow from this write primitive, all triggered from the same unauthenticated source and all self-renewing on a 24-hour cycle for as long as the injected rows remain in the database.	Server
CVE-2026-67400	Oct 27, 2026	Missing Token Type Check Exposes WOPI Config via Guest Token A missing token type check allowed to retrieve more additional information about the WOPI configuration with a user or guest token.	Richdocuments
CVE-2026-77165	Sep 21, 2026	File owners cannot unlock TYPE_TOKEN locks, causing permanent inaccessibility File owners were unable to unlock TYPE_TOKEN locks placed by other users, leaving files permanently locked with no recovery path outside of the database.	Server
CVE-2026-77166	Sep 21, 2026	Emoji Input Validation Failure Enables Sidebar Layout Abuse The emoji field in the page emoji update endpoint does not properly validate user input. By injecting long text and line breaks, the sidebar layout becomes broken and can hide other items.
CVE-2026-82985	Sep 18, 2026	Apple Photos Smart Album Info Disclosure via Search Config The Photos app's filter-based "smart albums" build their file listing using the search configuration (photosSourceFolders) of the user viewing the album, rather than the album owner's configuration. When an album owner shares a smart album with another user, that user's own folder configuration is used to determine which of the owner's files are searched allowing them to discover files (name, file ID, and other metadata) in folders the album owner never intended to include in the shared album. This requires the album owner to have shared a filter-based smart album with the attacker; it does not allow access to arbitrary users' files without such a share.	Server
CVE-2026-82982	Sep 18, 2026	Approval App Exposed: Missing ETag Bypasses Freshness Check The Approval app's approve/reject endpoint is meant to require the file's current etag as a freshness check, preventing an approver from approving or rejecting a file whose contents changed after they reviewed it. The backend only enforced this check when the etag parameter was present and non-empty in the request. An attacker able to intercept and modify the approval request could omit the etag field entirely, bypassing the freshness check and approving or rejecting a file version they never reviewed.
CVE-2026-82980	Sep 18, 2026	Nextcloud: Authenticated Cross-User WebDAV Lock/Unlock Exploit Any authenticated user can lock or unlock files they do not own by targeting absolute WebDAV paths of other users. The DAV plugin resolves files from the absolute request URI without verifying that the path segment matches the authenticated session user. This enables: Cross-user manual locks : attacker locks a victim's files, blocking writes (PUT/MOVE/DELETE, editor saves). Lock-token disclosure: the app returns the lock token to unauthorized callers, enabling them to remove token-based locks (client locks) of other users.
CVE-2026-77170	Sep 18, 2026	Auth Bypass: Deck Config API Allows Arbitrary Board ID Updates (CVE-2026-77170) The Deck config API allows authenticated users to set board-scoped configuration keys for arbitrary board IDs without validating whether the user owns or has permission to manage the referenced board.	Deck
CVE-2026-77169	Sep 18, 2026	Box Team Folder API Bypass via Workspace App Delegated Admin A vulnerability in the team folders (formerly group folders) app when used in combination with the workspace app allowed API/REST-only delegated administrators to bypass folder-level authorization controls. The workspace app enables organizations to delegate limited administrative privileges for team folder management via API/REST only, restricting access to folders for which the admin has advanced permissions.
CVE-2026-77164	Sep 18, 2026	SSRF via Circles App Remote Instance KeyID Fetch Circles' remote-instance signature verification fetches the attacker-supplied keyId URL before trust in the remote instance is established, and explicitly allows local/private addresses for this request, bypassing Nextcloud's core SSRF protections. The public, unauthenticated endpoints POST /apps/circles/event/ and POST /apps/circles/incoming/ reach this code path, allowing any unauthenticated user to force the server to issue a GET request to an internal address. The response body of the internal request is never returned to the requester, so this is blind SSRF: an attacker can determine whether an internal service is reachable, but cannot read its response contents through this endpoint alone.	Server
CVE-2026-68493	Sep 18, 2026	IDOR: View Circle Memberships via Guessed 15char ID After guessing a 62^15 complex unique identifier, a malicious logged in user was able to retrieve a list of memberships for a circle they are not a member of.	Server
CVE-2026-45810	Jun 01, 2026	Nextcloud Server 31.x-32.x: Auth Users Read All Comments Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 31.0.0 to before 31.0.12, and 32.0.0 to before 32.0.3, a missing check of a relation allowed authenticated users with access to any file comment, to read the content of all comments. It is recommended that the Nextcloud Server is upgraded to 31.0.12 or 32.0.3. It is recommended that the Nextcloud Enterprise Server is upgraded to 21.0.9.20, 22.2.10.35, 23.0.12.31, 24.0.12.30, 25.0.13.25, 26.0.13.22, 27.1.11.22, 28.0.14.13, 29.0.16.10, 30.0.17.5, 31.0.12 or 32.0.3
CVE-2026-45722	Jun 01, 2026	SQLi via ORDER BY in Nextcloud Tables app 0.9.0-0.9.6, 1.0.0-1.0.1 Nextcloud is an open source content collaboration platform. From versions 0.9.0 to before 0.9.7, and 1.0.0 to before 1.0.2, a missing sanitization in the Tables app allowed a user with access to the tables app to perform a limited SQL injection in the ORDER BY statement of a query. Compared to normal SQL injections, the ORDER BY is limited to extracting a single bit of information per request or to make the database wait for a given time. This issue has been patched in versions 0.9.7 and 1.0.2.
CVE-2026-45691	Jun 01, 2026	Nextcloud Server 32/33: Session Cookie Reused as Bearer Token Bypass 2FA Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, a pre-2FA session cookie (created after successful password authentication but before TOTP completion) could be reused as a Bearer token to authenticate against DAV endpoints, granting read/write access and bypassing mandatory two-factor authentication. It is recommended that the Nextcloud Server is upgraded to 33.0.3 or 32.0.9. It is recommended that the Nextcloud Enterprise Server is upgraded to 33.0.3, 32.0.9, 31.0.14.5, 30.0.17.9 or 29.0.16.16
CVE-2026-45690	Jun 01, 2026	Nextcloud Server 2FA Auth Bypass v32.0.0-32.0.8, 33.0.0-33.0.2 Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, an authentication bypass vulnerability allowed attackers with knowledge of a user's password to circumvent two-factor authentication (2FA) protections. When a user initiated login with valid credentials on a 2FA-enabled account, the system created a temporary session token before enforcing the second factor challenge. This token could be extracted and replayed via HTTP Basic Authentication to gain unauthorized access to authenticated endpoints. It is recommended that the Nextcloud Server is upgraded to 33.0.3 or 32.0.9. It is recommended that the Nextcloud Enterprise Server is upgraded to 33.0.3, 32.0.9, 31.0.14.5, 30.0.17.9 or 29.0.16.16
CVE-2026-45545	Jun 01, 2026	Nextcloud Tables app SQLi 0.7.00.7.6,0.8.00.8.9,0.9.00.9.7,1.0.01.0.3 Nextcloud is an open source content collaboration platform. From versions 0.7.0 to before 0.7.7, 0.8.0 to before 0.8.10, 0.9.0 to before 0.9.8, and 1.0.0 to before 1.0.4, an authenticated attacker with access to the Tables app may be able to execute arbitrary up to 20 bytes long SQL queries, through a stored injection. With carefully crafted input it is possible to break out of the length limitation. The attacker could use this to extract information from the database, or modify data. This issue has been patched in versions 0.7.7, 0.8.10, 0.9.8, 1.0.4, and 2.0.0.
CVE-2026-45544	Jun 01, 2026	Nextcloud Tables View Filter Disclosure (1.0.3) Nextcloud is an open source content collaboration platform. From version 0.8.0 to before version 1.0.4, the view filter criteria is exposed to users with read-only permissions in Nextcloud Tables. This issue has been patched in versions 1.0.4 and 2.0.0.
CVE-2026-45543	Jun 01, 2026	Nextcloud 4.3.05.2.6: Unauthorized File Read by Removed Collaborator Nextcloud is an open source content collaboration platform. From version 4.3.0 to before version 5.2.7, a removed collaborator retains unauthorized read access to uploaded respondent files for the affected form. The scope is limited to uploaded files for forms where that user previously had results access. This issue has been patched in version 5.2.7.
CVE-2026-45286	Jun 01, 2026	User Enumeration via Calendar Suggest in Nextcloud <5.5.17 & <6.2.3 Nextcloud is an open source content collaboration platform. From versions 5.5.13 to before 5.5.17, and 6.2.0 to before 6.2.3, an authenticated user can enumerate users on the same Nextcloud instance by using the Calendar app's endpoint for suggesting attendees. The sharing restrictions, applied to other endpoints, were not effective here. This issue has been patched in versions 5.5.17 and 6.2.3.
CVE-2026-45284	Jun 01, 2026	Nextcloud LDAP Auth Bypass for Deleted Users (pre-8.4) Nextcloud is an open source content collaboration platform. From version 1.3.6 to before version 8.4.0, an improper check allowed users that where provided by LDAP to still authenticate towards user OIDC after they where deleted. This issue has been patched in version 8.4.0.
CVE-2026-45285	Jun 01, 2026	Nextcloud Team External Public Link Leak v32.0.0-32.0.8 v33.0.0-33.0.2 Nextcloud is an open source content collaboration platform. From versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, when a user shares a folder or file with a Nextcloud Team that includes an external member (a person added via email address who does not have a Nextcloud account), the system automatically creates a public link for that external member. This public link is not displayed in the share section of the folder, so the folder owner has no knowledge of its existence. It is sent via email to the external member. It grants the same permissions (read, write, delete, reshare, download) as the Teams access. An attacker who receives or intercepts this link can access, modify, delete, reshare, and download all data in the shared folder without any further authentication. The folder owner cannot see or revoke the link through the normal sharing interface. This issue has been patched in versions 32.0.9 and 33.0.3.
CVE-2026-45283	Jun 01, 2026	Nextcloud Server 32.x/33.x files_lock WebDAV Ownership Flaw Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.2, and 33.0.0 to before 33.0.1, the files_lock app did not properly validate the ownership of files when processing DAV lock and unlock requests. An authenticated user could lock or unlock files belonging to other users by targeting their absolute WebDAV paths. Additionally, lock tokens were disclosed to unauthorized callers in error responses, allowing attackers to remove token-based locks placed by other users' client applications. It is recommended that the Nextcloud Server is upgraded to 32.0.2 or 33.0.1. It is recommended that the Nextcloud Enterprise Server is upgraded to 31.0.14.4 or 32.0.2 or 33.0.1
CVE-2026-45282	Jun 01, 2026	Nextcloud Server <32.0.9, 33.0.0<33.0.3: Token bypass attachments (CVE202645282) Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, an authenticated attacker can access attachments of link shares when knowing the share token, circumventing password protection or download restrictions. It is applicable to any file that is shared directly, as the attacker only needs to know a documentId they own, apart of the mentioned share token. For shared folders the attacker has to know or guess a documentId of a file that is included inside the folder, making it much harder to exploit. The attacker can only extract an attachments, but not the file shared file or folder itself. It is recommended that the Nextcloud Server is upgraded to 33.0.3 or 32.0.9. It is recommended that the Nextcloud Enterprise Server is upgraded to 33.0.3, 32.0.9, 31.0.14.5, 30.0.17.9, 29.0.16.16, 28.0.14.17 or 27.1.11.5
CVE-2026-45281	Jun 01, 2026	Nextcloud Server Calendar AuthZ Flaw in 32.x & 33.x (before 32.0.9/33.0.3) Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, with the knowledge of other users principal URL an attacker could possibly send a request to gain full access to their calendar. Therefore, the attacker must be an authenticated user. This is because of improper authorization controls in the backend of the calendar. If the attacker had access to the calendar, they would be able to view and modify it. It is recommended that the Nextcloud Server is upgraded to 33.0.3 or 32.0.9. It is recommended that the Nextcloud Enterprise Server is upgraded to 33.0.3, 32.0.9, 31.0.14.5, 30.0.17.9, 29.0.16.16, 28.0.14.17, 27.1.11.26, 26.0.13.26, 25.0.13.29, 24.0.12.34, 23.0.12.35, 22.2.10.39, or 21.0.9.23
CVE-2026-45279	Jun 01, 2026	Nextcloud Server path traversal copy file via {lang} tmpl (31.013 & 32.03) Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 31.0.0 to before 31.0.14, and 32.0.0 to before 32.0.4, if {lang} is used in the template directory config value, non-admin users can in some cases copy arbitrary files (depending on unix permissions) into their own Nextcloud directory via a path traversal. It is recommended that the Nextcloud Server is upgraded to 32.0.4, 31.0.14. It is recommended that the Nextcloud Enterprise Server is upgraded to 32.0.4, 31.0.14, 30.0.17.7, 29.0.17.12, 28.0.14.15
CVE-2026-45278	Jun 01, 2026	Open redirect via OIDC in Nextcloud 6.1.08.2.1 Nextcloud is an open source content collaboration platform. From version 6.1.0 to before version 8.2.2, an attacker can craft links that would redirect users to another website, when the victim uses the attackers link to log in via user OIDC. This issue has been patched in version 8.2.2.
CVE-2026-45277	Jun 01, 2026	Nextcloud <=2.7.1: AuthU File Disclosure in App WKF (CVE-2026-45277) Nextcloud is an open source content collaboration platform. Prior to version 2.7.2, authenticated users can check if arbitrary files are associated with specific approval workflows where they can request approval. This issue has been patched in version 2.7.2.
CVE-2026-45275	Jun 01, 2026	Privilege Escalation in Nextcloud Approval App (Before 2.7.2) Nextcloud is an open source content collaboration platform. Prior to version 2.7.2, a privilege escalation vulnerability exists in the Approval app that allows a user without sharing permissions to force the system to share a file with approvers. This results in an authorization bypass and privilege escalation, allowing unauthorized distribution of restricted files. This issue has been patched in version 2.7.2.
CVE-2026-45267	Jun 01, 2026	Nextcloud v<=5.2.6: Missing perm. check allows cross-user form read Nextcloud is an open source content collaboration platform. Prior to version 5.2.6, a missing permissions check allowed users to request reading form submissions of other users. This issue has been patched in version 5.2.6.
CVE-2026-45266	Jun 01, 2026	Nextcloud <21.1.10/22.0.11/23.0.3: low-priv user muting mic in calls Nextcloud is an open source content collaboration platform. Prior to versions 21.1.10, 22.0.11, and 23.0.3, a low-privileged user can force other user's microphones to be muted in calls when no High-performance Backend is installed. This issue has been patched in versions 21.1.10, 22.0.11, and 23.0.3.
CVE-2026-45159	Jun 01, 2026	Nextcloud EE File Drop Bypass (1.15.01.18.1) Nextcloud is an open source content collaboration platform. From versions 1.15.0 to before 1.15.4, 1.16.0 to before 1.16.3, 1.17.0 to before 1.17.1, and 1.18.0 to before 1.18.1, a malicious user with access to an end-to-end encrypted files drop link was able to also drop files into other end-to-end encrypted folders of the share owner. Reading and modifying of other files was not possible. This issue has been patched in versions 1.15.4, 1.16.3, 1.17.1, 1.18.1, and 2.0.0-rc.7.
CVE-2026-45157	Jun 01, 2026	Nextcloud Share Token Abuse: Chunks Visible (32.0.032.0.9/33.0.033.0.3) Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, when a malicious user has access to a file share of a user, they could use this share token to also access the chunking upload directly and see temporary part files during on going uploads. It is recommended that the Nextcloud Server is upgraded to 32.0.9 or 33.0.3. It is recommended that the Nextcloud Enterprise Server is upgraded to 26.0.13.26, 27.1.11.25, 28.0.14.17, 29.0.16.16, 30.0.17.9, 31.0.14.5, 32.0.9 or 33.0.3
CVE-2026-45156	Jun 01, 2026	Nextcloud OIDC ID4me Impersonation Missing Sig Verif (3.0, 5.05.1...) Nextcloud is an open source content collaboration platform. From versions 0.3.0 to before 3.1.0, 5.0.0 to before 5.1.0, and 6.0.0 to before 6.4.0, a missing signature verification in User OIDC allowed a malicious ID4me authority to identify as any user. This issue has been patched in versions 3.1.0, 4.1.0, 5.1.0, 6.4.0 and 8.3.0.
CVE-2026-45155	Jun 01, 2026	Nextcloud Server <32.0.7 & <33.0.1 Circle Privilege Escalation Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.7 and 33.0.0 to before 33.0.1, a missing access check on API level allowed to add unknown circles by their ID directly to other circles. Since circle IDs have 62^15 complexity by default this is still unlikely to be executable at will, but if access to an ID was available via another source, memberships could be tracked like this. It is recommended that the Nextcloud Server is upgraded to 32.0.7 or 33.0.1. It is recommended that the Nextcloud Enterprise Server is upgraded to 29.0.16.14, 30.0.17.8, 31.0.14.3, 32.0.7 or 33.0.1
CVE-2026-45154	Jun 01, 2026	Nextcloud <4.3.0: View-Only Guests Access Deleted Pages via Trashbin Nextcloud is an open source content collaboration platform. From version 2.6.0 to before version 4.3.0, when a previous collective pages was deleted and the collective was shared view-only, guests with access to the collective were able to access the deleted pages directly from the trashbin. This issue has been patched in version 4.3.0.
CVE-2026-45153	Jun 01, 2026	Nextcloud Files Android PIN bypass via back button before 33.1.0 Nextcloud is an open source content collaboration platform. From version 33.0.0 to before version 33.1.0, after unlocking a locked Android phone the back-button could be used to bypass the Nextcloud Files app PIN. This issue has been patched in version 33.1.0.
CVE-2026-45264	Jun 01, 2026	Nextcloud Team Folder Rename Bypass (v17-21) Patch v17.0.15/18.1.12/19.1.16/20.1.11/21.0.4 Nextcloud is an open source content collaboration platform. From versions 17.0.0 to before 17.0.15, 18.0.0 to before 18.1.12, 19.0.0 to before 19.1.16, 20.0.0 to before 20.1.11, and 21.0.0 to before 21.0.4, a user with READ and CREATE permission, but no UPDATE permission for a team folder can rename files in the team folder. This issue has been patched in versions 17.0.15, 18.1.12, 19.1.16, 20.1.11, and 21.0.4.
CVE-2026-44515	May 14, 2026	Nextcloud News <=28.3.0-beta.1 Blind SSRF via Feed URL Nextcloud News is an RSS/Atom feed reader. Prior to 28.3.0-beta.1, Nextcloud News allows authenticated users to add feeds by providing a feed URL (via the web interface or the API). In affected versions, an authenticated attacker could provide a URL pointing to internal/private IP ranges or localhost, causing the Nextcloud server to perform server-side HTTP requests to attacker-controlled destinations, but not relaying the result. This enables blind SSRF, which can be used to scan or probe internal network services that are reachable from the Nextcloud server. This vulnerability is fixed in 28.3.0-beta.1.
CVE-2026-23696	Apr 07, 2026	Windmill 1.603.2 SQLi in Folder Ownership via owner Param Windmill CE and EE versions 1.276.0 through 1.603.2 contain an SQL injection vulnerability in the folder ownership management functionality that allows authenticated attackers to inject SQL through the owner parameter. An attacker can use the injection to read sensitive data such as the JWT signing secret and administrative user identifiers, forge an administrative token, and then execute arbitrary code via the workflow execution endpoints.
CVE-2026-22683	Apr 07, 2026	Windmill 1.56.0-1.614.0 AuthZ Flaw: Operator Escalates to RCE via API Windmill versions 1.56.0 through 1.614.0 contain a missing authorization vulnerability that allows users with the Operator role to perform prohibited entity creation and modification actions via the backend API. Although Operators are documented and priced as unable to create or modify entities, the API does not enforce the Operator restriction on workspace endpoints, allowing an Operator to create and update scripts, flows, apps, and raw_apps. Since Operators can also execute scripts via the jobs API, this allows direct privilege escalation to remote code execution within the Windmill deployment. This vulnerability has existed since the introduction of the Operator role in version 1.56.0.
CVE-2025-64011	Dec 12, 2025	Nextcloud Server 30.0.0 IDOR via /core/preview fileId Nextcloud Server 30.0.0 is vulnerable to an Insecure Direct Object Reference (IDOR) in the /core/preview endpoint. Any authenticated user can access previews of arbitrary files belonging to other users by manipulating the fileId parameter. This allows unauthorized disclosure of sensitive data, such as text files or images, without prior sharing permissions.	Server
CVE-2025-66558	Dec 05, 2025	Nextcloud TFA WebAuthn Devices: Missing Ownership Check (1.4.2/2.4.1) Nextcloud Twofactor WebAuthn is the WebAuthn Two-Factor Provider for Nextcloud. Prior to 1.4.2 and 2.4.1, a missing ownership check allowed an attack to take-away a 2FA webauthn device when correctly guessing a 80-128 character long random string of letters, numbers and symbols. The victim would then be prompted to register a new device on the next login. The attacker can not authenticate as the victim. This vulnerability is fixed in 1.4.2 and 2.4.1.	Nextcloud
CVE-2025-66556	Dec 05, 2025	Nextcloud Talk Poll Draft Deletion (CVE-2025-66556) fixed in 20.1.8/21.1.2 Nextcloud talk is a video & audio conferencing app for Nextcloud. Prior to 20.1.8 and 21.1.2, a participant with chat permissions was able to delete poll drafts of other participants within the conversation based on their numeric ID. This vulnerability is fixed in 20.1.8 and 21.1.2.	Talk