CVE-2026-107059

Vulnerability in the Tables app in Nextcloud (versions 0.7.0 to before 0.7.7, 0.8.0 to before 0.8.10, 0.9.0 to before 0.9.8, 1.0.0 to before 1.0.4). An authenticated attacker with access to the Tables app can execute arbitrary SQL queries up to 20 bytes long via stored injection. The length limitation can be bypassed.

Nextcloud from version 4.3.0 to before 5.2.7 allows a removed collaborator to retain unauthorized read access to uploaded respondent files for the affected form. The scope is limited to forms where that user previously had results access.

Nextcloud is an open source content collaboration platform. From versions 5.5.13 to before 5.5.17, and 6.2.0 to before 6.2.3, an authenticated user can enumerate users on the same Nextcloud instance by using the Calendar app's endpoint for suggesting attendees.

In Nextcloud from version 1.3.6 to before 8.4.0, an improper check allowed users provided by LDAP to still authenticate via OIDC after being deleted from LDAP.

Nextcloud is an open source content collaboration platform. From version 6.1.0 to before version 8.2.2, an attacker can craft links that would redirect users to another website, when the victim uses the attackers link to log in via user OIDC. This issue has been patched in version 8.2.2.

In Nextcloud prior to version 2.7.2, authenticated users can check if arbitrary files are associated with specific approval workflows where they can request approval. This issue has been patched in version 2.7.2.

In Nextcloud prior to version 5.2.6, a missing permissions check allowed users to request reading form submissions of other users. This issue has been patched in version 5.2.6.

In Nextcloud prior to versions 21.1.10, 22.0.11, and 23.0.3, a low-privileged user can force other users' microphones to be muted in calls when no High-performance Backend is installed.

In Nextcloud, an open source content collaboration platform, versions 17.0.0 to before 17.0.15, 18.0.0 to before 18.1.12, 19.0.0 to before 19.1.16, 20.0.0 to before 20.1.11, and 21.0.0 to before 21.0.4, a user with READ and CREATE permission but no UPDATE permission can rename files in a team folder. This has been patched in versions 17.0.15, 18.1.12, 19.1.16, 20.1.11, and 21.0.4.

In Nextcloud from versions 1.15.0 to before 1.15.4, 1.16.0 to before 1.16.3, 1.17.0 to before 1.17.1, and 1.18.0 to before 1.18.1, a malicious user with access to an end-to-end encrypted files drop link could drop files into other encrypted folders of the share owner. Reading and modifying other files was not possible.