CVE-2026-45722
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
In Nextcloud Tables (versions 0.9.0 to 0.9.7 and 1.0.0 to 1.0.2), missing sanitization allows a user with access to perform a limited SQL injection in the ORDER BY clause, enabling extraction of a single bit per request or database delay.
Risk Assessment
Risk of data leakage or database slowdown via limited SQL injection, affecting confidentiality and availability.
Recommendation
Update the Tables app to version 0.9.7 or 1.0.2.
Other vulnerabilities in Nextcloud Tables
See all- CVE-2026-45544Medium
Nextcloud Tables from version 0.8.0 to before 1.0.4 exposes view filter criteria to users with read-only permissions. This issue is patched in versions 1.0.4 and 2.0.0.
- CVE-2025-66553Medium
Nextcloud Tables (versions prior to 0.8.7 and 0.9.4) allows authenticated users to view metadata of columns in other tables of the Tables app by modifying the numeric ID in a request. This vulnerability is fixed in 0.8.7 and 0.9.4.
- CVE-2025-66551Medium
Nextcloud Tables before versions 0.8.6 and 0.9.3 allows a malicious user to create their own table and then move a column to a victim's table. This vulnerability is fixed in versions 0.8.6 and 0.9.3.
- CVE-2025-66513Medium
Nextcloud Tables prior to 0.8.9, 0.9.6, and 1.0.1 did not limit the information about which table (numeric ID) is shared with which groups or users and the respective permissions to privileged users. This vulnerability is fixed in 0.8.9, 0.9.6, and 1.0.1.
- CVE-2025-58051Medium
Nextcloud Tables allows you to create your own tables with individual columns. Prior to 0.7.6, 0.8.8, and 0.9.5, when importing a table, a user was able to specify files on the server and when their format is supported by the used PhpSpreadsheet library they would be included and their content leaked to the user.
Original NVD description (English source)
Nextcloud is an open source content collaboration platform. From versions 0.9.0 to before 0.9.7, and 1.0.0 to before 1.0.2, a missing sanitization in the Tables app allowed a user with access to the tables app to perform a limited SQL injection in the ORDER BY statement of a query. Compared to normal SQL injections, the ORDER BY is limited to extracting a single bit of information per request or to make the database wait for a given time. This issue has been patched in versions 0.9.7 and 1.0.2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS