CVE-2026-45286

Katalog CVE

CVSS 4.3 · Medium EPSS 0,46%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor pada nextcloud calendar. Skor CVSS 3.1 4.3 (Medium) menurut github.com.

Deskripsi (NVD)

Nextcloud is an open source content collaboration platform. From versions 5.5.13 to before 5.5.17, and 6.2.0 to before 6.2.3, an authenticated user can enumerate users on the same Nextcloud instance by using the Calendar app's endpoint for suggesting attendees. The sharing restrictions, applied to other endpoints, were not effective here. This issue has been patched in versions 5.5.17 and 6.2.3.

Rincian

Terbit di NVD

1 Juni 2026

Terakhir diubah

22 Juli 2026

Status NVD

Analyzed

CVSS 3.1

4.3 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

EPSS (30 hari)

0,46% peluang dieksploitasi; lebih tinggi dari 37,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-r697-74m9-gvf2 mitigasi · advisory vendor
• https://github.com/nextcloud/calendar/issues/7971 exploit · issue tracking · patch
• https://github.com/nextcloud/calendar/pull/8197 issue tracking · patch
• https://hackerone.com/reports/3540663 permissions required