Vulnerability Description
Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.2, and 33.0.0 to before 33.0.1, the files_lock app did not properly validate the ownership of files when processing DAV lock and unlock requests. An authenticated user could lock or unlock files belonging to other users by targeting their absolute WebDAV paths. Additionally, lock tokens were disclosed to unauthorized callers in error responses, allowing attackers to remove token-based locks placed by other users' client applications. It is recommended that the Nextcloud Server is upgraded to 32.0.2 or 33.0.1. It is recommended that the Nextcloud Enterprise Server is upgraded to 31.0.14.4 or 32.0.2 or 33.0.1
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Nextcloud | Nextcloud Server | >= 32.0.0, < 32.0.2 |
Related Weaknesses (CWE)
References
- https://github.com/nextcloud/files_lock/pull/1007Issue TrackingPatch
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-4chh-6Vendor Advisory
- https://hackerone.com/reports/3301553#Permissions Required
FAQ
What is CVE-2026-45283?
CVE-2026-45283 is a vulnerability with a CVSS score of 6.3 (MEDIUM). Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.2, and 33.0.0 to before 33.0.1, the files_lock app did not properly validate the own...
How severe is CVE-2026-45283?
CVE-2026-45283 has been rated MEDIUM with a CVSS base score of 6.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-45283?
Check the references section above for vendor advisories and patch information. Affected products include: Nextcloud Nextcloud Server.