CVE-2026-45154

2.6 lowEPSS 0.2%

Nextcloud is an open source content collaboration platform. From version 2.6.0 to before version 4.3.0, when a previous collective pages was deleted and the collective was shared view-only, guests with access to the collective were able to access the deleted pages directly from the trashbin. This issue has been patched in version 4.3.0.

Severity

CVSS 3.1

2.6 low

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N

EPSS: 0.2% chance of exploitation in the next 30 days; higher than 8% of CVEs (scores of 2026-10-31)
CWE: CWE-284
Published: 2026-06-01
Modified: 2026-07-22
Record from: the NVD, synced 2026-10-19

References

https://github.com/nextcloud/collectives/pull/2432
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-8mpv-ggq8-hf3w
https://hackerone.com/reports/3521434

Check your stack JSON