CVE-2026-45155
LowCVSS 2.6Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
In Nextcloud Server from versions 32.0.0 to before 32.0.7 and 33.0.0 to before 33.0.1, a missing access check allowed adding unknown circles by their ID to other circles. Due to ID complexity (62^15), exploitation is unlikely but possible if the ID is known, enabling membership tracking.
Risk Assessment
An attacker can track circle memberships, potentially violating user privacy.
Recommendation
Update Nextcloud Server to version 32.0.7 or 33.0.1, and Nextcloud Enterprise Server to 29.0.16.14, 30.0.17.8, 31.0.14.3, 32.0.7, or 33.0.1.
Original NVD description (English source)
Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.7 and 33.0.0 to before 33.0.1, a missing access check on API level allowed to add unknown circles by their ID directly to other circles. Since circle IDs have 62^15 complexity by default this is still unlikely to be executable at will, but if access to an ID was available via another source, memberships could be tracked like this. It is recommended that the Nextcloud Server is upgraded to 32.0.7 or 33.0.1. It is recommended that the Nextcloud Enterprise Server is upgraded to 29.0.16.14, 30.0.17.8, 31.0.14.3, 32.0.7 or 33.0.1