CVE-2026-45543

Published: Jun 1, 2026Modified: Jul 22, 2026

5.3

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Exploitability: 3.9 / Impact: 1.4

Source: security-advisories@github.com (Secondary)

Description

Nextcloud is an open source content collaboration platform. From version 4.3.0 to before version 5.2.7, a removed collaborator retains unauthorized read access to uploaded respondent files for the affected form. The scope is limited to uploaded files for forms where that user previously had results access. This issue has been patched in version 5.2.7.

Affected (1)

Products: Nextcloud: Forms

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Nextcloud Forms	From 4.3.0 to 5.2.7

Related CWEs

Files or Directories Accessible to External Parties

The product makes files or directories accessible to unauthorized actors, even though they should not be.

References (3)

https://github.com/nextcloud/forms/pull/3291

Source: security-advisories@github.com

Issue TrackingPatch

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-q4fw-6jf8-5vhh

Source: security-advisories@github.com

MitigationVendor Advisory

https://hackerone.com/reports/3617352

Source: security-advisories@github.com

Permissions Required

Timeline

No history available yet.