DeutschShown in its original language — a full translation is planned for a future version.
Nextcloud (Server, Tables, Whiteboard, Files Confidential, Collectives, Richdocuments): Mehrere Schwachstellen
view advisory published 2026-10-26
Ein Angreifer kann mehrere Schwachstellen in Nextcloud ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Daten zu manipulieren oder offenzulegen sowie Denial-of-Service-Zustände auszulösen.
01
describes (10)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-87897US | — | — | ||
A SSRF vulnerability found that enables access to internal Chrome Devtools Protocol APIs that can leak the JWT authentication token for another user. A low privileged attacker coul… | ||||
| CVE-2026-82986US | — | — | ||
The user in a group can bypass the group restriction set by an administrator on link sharing, creating share links for a table even though they shouldn't have that permission. | ||||
| CVE-2026-82984US | — | — | ||
When a team was configured as "visible to everyone", the web UI correctly blocked non-members from viewing the team ("You are not a member of ..."), but the resources API endpoint… | ||||
| CVE-2026-82983US | — | — | ||
The Tables app's share-listing endpoint (GET /apps/tables/share/table/{tableId}) did not verify that the requesting user has manage-level permission on the table before returning t… | ||||
| CVE-2026-77173US | — | — | ||
A user could create a docx or odt file with a # in the filename with confidential information such as a credit card number and have it not be marked as confidential. | ||||
| CVE-2026-77172US | — | — | ||
App passwords were allowed to bypass password confirmation on sensitive endpoints. | ||||
| CVE-2026-77171US | — | — | ||
A public shared collective always allowed recipients of the link to create pages. | ||||
| CVE-2026-77167US | — | — | ||
Abusing the federated share endpoint, an attacker can write arbitrary rows into the oc_share_external database table. These rows persist indefinitely — there is no automatic cleanu… | ||||
| CVE-2026-67400US | — | — | ||
A missing token type check allowed to retrieve more additional information about the WOPI configuration with a user or guest token. | ||||
| CVE-2026-114601US | — | — | ||
02
references
External citations — patches, advisories, analysis.
- GitHub Security Advisory GHSA-5572-968j-v7g5 vom 2026-10-26external
- GitHub Security Advisory GHSA-67c5-gw7r-w35f vom 2026-10-26external
- GitHub Security Advisory GHSA-6m4h-j3wr-v388 vom 2026-10-26external
- GitHub Security Advisory GHSA-c47x-m7w6-c4q8 vom 2026-10-26external
- GitHub Security Advisory GHSA-g8qc-xvwr-f684 vom 2026-10-26external
- GitHub Security Advisory GHSA-gxg4-gmhx-4qj3 vom 2026-10-26external
- GitHub Security Advisory GHSA-p9qq-6vpv-x7wj vom 2026-10-26external
- GitHub Security Advisory GHSA-qwm4-h3xh-gmvc vom 2026-10-26external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan