Overview
A notable security flaw has been found in Nextcloud Server, an open-source platform for content collaboration. This vulnerability allows an attacker to bypass the mandatory two-factor authentication (2FA) simply by reusing a specific session cookie. This cookie is generated right after a user enters their password but before they complete the 2FA step, like entering a code from an authenticator app. If this pre-2FA session cookie is captured, it can be used as a special key (Bearer token) to gain full read and write access to a user’s files and other data accessible via DAV endpoints, completely bypassing the extra layer of security that 2FA is meant to provide.
CVE Details
- Product: Nextcloud Server
- Published Date: June 1, 2026
- Severity: Medium
- Status: Analyzed
Affected Products
The vulnerability affects several versions of Nextcloud Server and Nextcloud Enterprise Server. Users should check if their installations fall within these ranges:
- Nextcloud Server: All versions from 32.0.0 up to, but not including, 32.0.9. Also, all versions from 33.0.0 up to, but not including, 33.0.3.
- Nextcloud Enterprise Server:
- All versions from 29.0.0 up to, but not including, 29.0.16.16.
- All versions from 30.0.0 up to, but not including, 30.0.17.9.
- All versions from 31.0.0 up to, but not including, 31.0.14.5.
- All versions from 32.0.0 up to, but not including, 32.0.9.
- All versions from 33.0.0 up to, but not including, 33.0.3.
Current Status
This vulnerability, identified as CVE-2026-45691, has been fully analyzed. The details, impact, and solutions have been thoroughly investigated and documented by the Nextcloud security team.
Severity Level
Rated as Medium severity with a CVSS score of 5.9. This rating indicates that while the vulnerability is significant, it might require specific conditions or a certain level of attacker skill to exploit. However, a successful exploit could lead to unauthorized read and write access to sensitive data, making it a serious concern for all Nextcloud users, especially those relying on 2FA for enhanced security.
Possible Solutions
Nextcloud has released patches to address this vulnerability. It is highly recommended to upgrade your Nextcloud installation immediately to a patched version to protect against potential exploitation. There are currently no known workarounds for this issue, making timely updates critical.
- For Nextcloud Server: Upgrade to version 33.0.3 or 32.0.9.
- For Nextcloud Enterprise Server: Upgrade to version 33.0.3, 32.0.9, 31.0.14.5, 30.0.17.9, or 29.0.16.16.
References
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-mp6x-g55j-w9jw
- https://github.com/nextcloud/server/pull/59758
- https://hackerone.com/reports/3573399
