CVE-2026-45155 Nextcloud: Private circle can be added to another circle via API
Attackers with circle IDs can add private circles to others via API, potentially tracking memberships due to missing access checks.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-45155?
CVE-2026-45155 is a low-severity missing authorization vulnerability in nextcloud security-advisories, published on 1 Jun 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.7 and 33.0.0 to before 33.0.1, a missing access check on API level allowed to add unknown circles by their ID directly to other circles. Since circle IDs have 62^15 complexity by default this is still unlikely to be executable at will, but if access to an ID was available via another source, memberships could be tracked like this. It is recommended that the Nextcloud Server is upgraded to 32.0.7 or 33.0.1. It is recommended that the Nextcloud Enterprise Server is upgraded to 29.0.16.14, 30.0.17.8, 31.0.14.3, 32.0.7 or 33.0.1
Weakness: CWE-639
Which versions are affected by CVE-2026-45155?
How do I fix CVE-2026-45155?
No fix has been published for CVE-2026-45155 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-45155 being exploited?
There is no known exploitation of CVE-2026-45155 in the wild and no public exploit code.
Sources
Also known as GHSA-xpgv-grf9-gm7x.