Understanding the Nextcloud Calendar Vulnerability
A significant security flaw has been identified in Nextcloud Server, an open-source platform widely used for content collaboration. This vulnerability, tracked as CVE-2026-45281, could allow an authenticated attacker to gain full, unauthorized access to another user’s calendar. This means an attacker could view, modify, and potentially delete sensitive calendar entries, severely impacting user privacy and data integrity.
The root cause lies in inadequate authorization controls within the calendar’s backend. For an attack to succeed, the malicious actor would need to know the target user’s principal URL, but crucially, they must also be an authenticated user on the Nextcloud instance.
CVE Details
- CVE ID: CVE-2026-45281
- Published Date: June 1, 2026
- Severity: High
- Status: Analyzed
Affected Products
This vulnerability impacts several versions of Nextcloud Server and Nextcloud Enterprise Server:
- Nextcloud Server: Versions 32.0.0 up to, but not including, 32.0.9, and versions 33.0.0 up to, but not including, 33.0.3.
- Nextcloud Enterprise Server: All versions from 21.0.0 up to, but not including, 21.0.9.23; 22.0.0 up to, but not including, 22.2.10.39; 23.0.0 up to, but not including, 23.0.12.35; 24.0.0 up to, but not including, 24.0.12.34; 25.0.0 up to, but not including, 25.0.13.29; 26.0.0 up to, but not including, 26.0.13.26; 27.0.0 up to, but not including, 27.1.11.26; 28.0.0 up to, but not including, 28.0.14.17; 29.0.0 up to, but not including, 29.0.16.16; 30.0.0 up to, but not including, 30.0.17.9; 31.0.0 up to, but not including, 31.0.14.5; 32.0.0 up to, but not including, 32.0.9; and 33.0.0 up to, but not including, 33.0.3.
Current Status
The vulnerability is currently “Analyzed,” meaning it has been thoroughly investigated and understood by security researchers and the vendor.
Severity Level
CVE-2026-45281 has been assigned a High severity rating with a CVSS score of 8.1. This high score is due to several factors:
- Attack Vector: Network (meaning it can be exploited remotely over a network).
- Attack Complexity: Low (making it relatively easy for an attacker to carry out).
- Privileges Required: Low (an attacker only needs basic user privileges).
- User Interaction: None (no user action is needed for the attack to work).
- Confidentiality and Integrity: High impact (an attacker can fully access and alter private calendar data).
The combination of these factors indicates a serious risk that could lead to significant data breaches and compromise of personal information for affected Nextcloud users.
Possible Solutions
Nextcloud has released patches to address this vulnerability. It is strongly recommended to upgrade your Nextcloud installation immediately.
- For Nextcloud Server: Upgrade to version 33.0.3 or 32.0.9.
- For Nextcloud Enterprise Server: Upgrade to versions 33.0.3, 32.0.9, 31.0.14.5, 30.0.17.9, 29.0.16.16, 28.0.14.17, 27.1.11.26, 26.0.13.26, 25.0.13.29, 24.0.12.34, 23.0.12.35, 22.2.10.39, or 21.0.9.23.
Workarounds (If immediate patching is not possible)
If you cannot apply the patches right away, Nextcloud suggests these temporary mitigation steps:
- Block access to the following endpoints:
remote.php/dav/principals/users/<userid>/calendar-proxy-readremote.php/dav/principals/users/<userid>/calendar-proxy-write - If you suspect data integrity issues or need to reset records, clear the
oc_dav_cal_proxytable.
References
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-hrrv-mp25-26vv
https://github.com/nextcloud/server/pull/59962
https://hackerone.com/reports/3545964
