Nextcloud Server
9 CVEs affecting Nextcloud Server. Latest disclosed: 2026-10-27. Critical: 0, High: 2.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-41178 | High | 8.8 | 2021-10-25 | Nextcloud is an open-source, self-hosted productivity platform. Prior to versions 20.0.13, 21.0.5, and 22.2.0, a file traversal vulnerability makes an attacker… |
CVE-2026-77167 | High | 7.5 | 2026-10-27 | Abusing the federated share endpoint, an attacker can write arbitrary rows into the oc_share_external database table. These rows persist indefinitely — there i… |
CVE-2026-77165 | Medium | 6.5 | 2026-09-21 | File owners were unable to unlock TYPE_TOKEN locks placed by other users, leaving files permanently locked with no recovery path outside of the database. |
CVE-2026-82985 | Medium | 6.5 | 2026-09-18 | The Photos app's filter-based "smart albums" build their file listing using the search configuration (photosSourceFolders) of the user viewing the album, rathe… |
CVE-2021-41179 | Medium | 6.5 | 2021-10-25 | Nextcloud is an open-source, self-hosted productivity platform. Prior to Nextcloud Server versions 20.0.13, 21.0.5, and 22.2.0, the Two-Factor Authentication w… |
CVE-2026-77164 | Medium | 6.2 | 2026-09-18 | Circles' remote-instance signature verification fetches the attacker-supplied keyId URL before trust in the remote instance is established, and explicitly allo… |
CVE-2026-77172 | Medium | 5.3 | 2026-10-27 | App passwords were allowed to bypass password confirmation on sensitive endpoints. |
CVE-2026-82984 | Medium | 4.3 | 2026-10-27 | When a team was configured as "visible to everyone", the web UI correctly blocked non-members from viewing the team ("You are not a member of ..."), but the re… |
CVE-2026-68493 | Low | 3.1 | 2026-09-18 | After guessing a 62^15 complex unique identifier, a malicious logged in user was able to retrieve a list of memberships for a circle they are not a member of. |