Uncovering a Privacy Flaw in Nextcloud Calendar
Nextcloud, a popular open-source platform for content collaboration, recently addressed a privacy concern within its Calendar application. This vulnerability, identified as CVE-2026-45286, allowed authenticated users to gather a list of all other users on the same Nextcloud instance. This could happen even when administrators had set up strict privacy controls to prevent such information from being shared.
Normally, Nextcloud’s sharing restrictions work well across various parts of the platform. However, the Calendar app’s feature for suggesting attendees didn’t properly respect these settings. This oversight meant that if an authenticated user started typing in the attendee suggestion field for a calendar event, the system would autocomplete with a list of all users, including their email addresses, regardless of any privacy configurations.
CVE Details
- Product Name: Nextcloud Calendar
- CVE ID: CVE-2026-45286
- Published Date: June 1, 2026
- Severity: Medium
- Status: Analyzed
Affected Products
This user enumeration vulnerability impacts specific versions of the Nextcloud Calendar app:
- Versions 5.5.13 up to, but not including, 5.5.17
- Versions 6.2.0 up to, but not including, 6.2.3
Current Status
The vulnerability has been thoroughly analyzed and addressed by the Nextcloud development team. Fixes have been released to correct the issue and restore the intended privacy controls within the Calendar application.
Severity Level
Rated as “Medium” severity, this vulnerability is concerning primarily due to its impact on user privacy. While it doesn’t allow for direct unauthorized access or data manipulation, the ability for any authenticated user to enumerate other users on a system can be a significant data protection issue. In environments where user separation and privacy are critical, this could lead to unintended information disclosure.
Possible Solutions
The good news is that Nextcloud has already provided solutions for this vulnerability. Users and administrators should update their Nextcloud Calendar application to the patched versions as soon as possible:
- For the 5.x branch, update to version 5.5.17 or later.
- For the 6.x branch, update to version 6.2.3 or later.
Applying these updates will ensure that the Calendar app respects the configured sharing restrictions, preventing unauthorized user enumeration.
References
https://github.com/nextcloud/calendar/issues/7971
https://github.com/nextcloud/calendar/pull/8197
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-r697-74m9-gvf2
https://hackerone.com/reports/3540663
