CVE-2026-45286

Description

Nextcloud is an open source content collaboration platform. From versions 5.5.13 to before 5.5.17, and 6.2.0 to before 6.2.3, an authenticated user can enumerate users on the same Nextcloud instance by using the Calendar app's endpoint for suggesting attendees. The sharing restrictions, applied to other endpoints, were not effective here. This issue has been patched in versions 5.5.17 and 6.2.3.

PUBLISHED Reserved 2026-05-11 | Published 2026-06-01 | Updated 2026-06-01 | Assigner GitHub_M

Problem types

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

Product status

References

github.com/...sories/security/advisories/GHSA-r697-74m9-gvf2

github.com/nextcloud/calendar/issues/7971

github.com/nextcloud/calendar/pull/8197

hackerone.com/reports/3540663

cve.org (CVE-2026-45286)

nvd.nist.gov (CVE-2026-45286)

Download JSON