Understanding the Nextcloud File Comment Exposure
Nextcloud, a popular open-source content collaboration platform, has identified a security flaw that could allow sensitive information to be accessed. This vulnerability, tracked as CVE-2026-45810, essentially allows certain authenticated users to view file comments they shouldn’t have access to. It’s an “information disclosure” issue because it exposes data that should remain private.
CVE Details
Product: Nextcloud Server
Published Date: June 1, 2026
Severity: Medium
Status: Analyzed
Affected Products
The vulnerability impacts specific versions of both Nextcloud Server and Nextcloud Enterprise Server:
- Nextcloud Server: All versions from 31.0.0 up to, but not including, 31.0.12, and all versions from 32.0.0 up to, but not including, 32.0.3.
- Nextcloud Enterprise Server: This affects various versions up to specific patch levels. Specifically, all versions prior to 21.0.9.20, 22.2.10.35, 23.0.12.31, 24.0.12.30, 25.0.13.25, 26.0.13.22, 27.1.11.22, 28.0.14.13, 29.0.16.10, 30.0.17.5, 31.0.12, and 32.0.3 are vulnerable.
Current Status
The vulnerability has been thoroughly analyzed. Details regarding its impact and recommended solutions are available to help users secure their installations.
Severity Level
CVE-2026-45810 is rated with a Medium severity, carrying a CVSS score of 6.8 out of 10. This rating indicates that while an attacker needs to be an authenticated user with low privileges and some user interaction is required, exploiting this flaw could lead to a high impact on confidentiality. Specifically, it allows an unauthorized user to read the content of all comments associated with files on the Nextcloud instance.
Possible Solutions
The good news is that patches are available to address this vulnerability. Users are strongly advised to update their Nextcloud installations immediately:
- For Nextcloud Server: Upgrade to version 31.0.12 or 32.0.3.
- For Nextcloud Enterprise Server: Upgrade to the latest patched version suitable for your current major release. Recommended upgrades include 21.0.9.20, 22.2.10.35, 23.0.12.31, 24.0.12.30, 25.0.13.25, 26.0.13.22, 27.1.11.22, 28.0.14.13, 29.0.16.10, 30.0.17.5, 31.0.12, or 32.0.3.
At present, no workarounds are available, making the application of these patches crucial for maintaining data privacy.
References
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-285v-p9x9-cjhj
https://github.com/nextcloud/server/pull/56982
https://hackerone.com/reports/3425534
