← Back

CVE-2026-45286

nvd nist
Published: Jun 1, 2026Modified: Jul 22, 2026

JSON object

Loading...
4.3
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Exploitability: 2.8 / Impact: 1.4
Source: security-advisories@github.com (Secondary)

Description

Nextcloud is an open source content collaboration platform. From versions 5.5.13 to before 5.5.17, and 6.2.0 to before 6.2.3, an authenticated user can enumerate users on the same Nextcloud instance by using the Calendar app's endpoint for suggesting attendees. The sharing restrictions, applied to other endpoints, were not effective here. This issue has been patched in versions 5.5.17 and 6.2.3.

Affected (2)

Products: Nextcloud: Calendar
Nextcloud
1 product
Calendar
Configuration A
2 vulnerable
Vulnerable SoftwareAffected Versions
Nextcloud
Calendar
From 5.5.13 to 5.5.17
Calendar
From 6.2.0 to 6.2.3

Related CWEs

CWE-200
Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (4)

Source: security-advisories@github.com
ExploitIssue TrackingPatch
Source: security-advisories@github.com
Issue TrackingPatch
Source: security-advisories@github.com
MitigationVendor Advisory
Source: security-advisories@github.com
Permissions Required

Timeline

No history available yet.