CVE-2026-45281
Authorization Bypass in Nextcloud Server Calendar
Publication date: 2026-06-01
Last updated on: 2026-06-01
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| nextcloud | enterprise_server | From 21.0.0 (inc) to 33.0.0 (inc) |
| nextcloud | server | From 32.0.0 (inc) to 32.0.9 (exc) |
| nextcloud | server | From 33.0.0 (inc) to 33.0.3 (exc) |
| nextcloud | enterprise_server | to 33.0.3 (inc) |
| nextcloud | enterprise_server | to 32.0.9 (inc) |
| nextcloud | enterprise_server | to 31.0.14.5 (inc) |
| nextcloud | enterprise_server | to 30.0.17.9 (inc) |
| nextcloud | enterprise_server | to 29.0.16.16 (inc) |
| nextcloud | enterprise_server | to 28.0.14.17 (inc) |
| nextcloud | enterprise_server | to 27.1.11.26 (inc) |
| nextcloud | enterprise_server | to 26.0.13.26 (inc) |
| nextcloud | enterprise_server | to 25.0.13.29 (inc) |
| nextcloud | enterprise_server | to 24.0.12.34 (inc) |
| nextcloud | enterprise_server | to 23.0.12.35 (inc) |
| nextcloud | enterprise_server | to 22.2.10.39 (inc) |
| nextcloud | enterprise_server | to 21.0.9.23 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-639 | The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows an authenticated attacker to gain full access to another user's calendar, enabling them to view and modify calendar data due to improper authorization controls.
This unauthorized access to personal or sensitive calendar information could lead to violations of data protection regulations such as GDPR or HIPAA, which require strict controls on access to personal and sensitive data.
Therefore, the vulnerability poses a risk to compliance with these standards by potentially exposing confidential user information without proper authorization.
Can you explain this vulnerability to me?
CVE-2026-45281 is a high-severity vulnerability in Nextcloud Server and Enterprise Server that allows an authenticated attacker to gain full access to another user's calendar.
The attacker must know the other user's principal URL and exploit improper authorization controls in the backend of the calendar application to send a request that grants them full access.
This means the attacker can view and modify the victim's calendar data without proper permission.
How can this vulnerability impact me? :
This vulnerability can lead to unauthorized access and modification of your calendar data by an authenticated attacker.
Such unauthorized access compromises the confidentiality and integrity of your calendar information, potentially exposing sensitive scheduling details or allowing malicious changes.
The CVSS score of 8.1 reflects a high risk, emphasizing the significant impact on confidentiality and integrity.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves an authenticated attacker sending requests with knowledge of other users' principal URLs to gain unauthorized access to their calendars. Detection can focus on monitoring for unusual or unauthorized CalDAV requests targeting calendar endpoints.
As a temporary workaround, it is recommended to check for suspicious access patterns to calendar delegation endpoints or to inspect the oc_dav_cal_proxy table for unexpected entries that might indicate exploitation attempts.
Specific commands are not provided in the available resources, but administrators can monitor web server logs for unusual authenticated requests to calendar-related URLs or query the database table oc_dav_cal_proxy for anomalies.
What immediate steps should I take to mitigate this vulnerability?
The primary mitigation is to upgrade Nextcloud Server to version 33.0.3 or 32.0.9, or to upgrade Nextcloud Enterprise Server to one of the patched versions such as 33.0.3, 32.0.9, 31.0.14.5, or other listed patched releases.
If immediate patching is not possible, a temporary workaround includes blocking access to specific calendar delegation endpoints and clearing the oc_dav_cal_proxy table to prevent unauthorized calendar access.