CVE-2026-45286 Nextcloud: Calendar app leaked user identifiers via attendee suggestion endpoint
Authenticated users can enumerate other users on the Nextcloud instance via the Calendar app's attendee suggestion endpoint, bypassing sharing restrictions.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-45286?
CVE-2026-45286 is a medium-severity vulnerability in nextcloud security-advisories, published on 1 Jun 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Nextcloud is an open source content collaboration platform. From versions 5.5.13 to before 5.5.17, and 6.2.0 to before 6.2.3, an authenticated user can enumerate users on the same Nextcloud instance by using the Calendar app's endpoint for suggesting attendees. The sharing restrictions, applied to other endpoints, were not effective here. This issue has been patched in versions 5.5.17 and 6.2.3.
Weakness: CWE-200
Which versions are affected by CVE-2026-45286?
It affects 1 product.
Products include Nextcloud Calendar.
How do I fix CVE-2026-45286?
No fix has been published for CVE-2026-45286 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-45286 being exploited?
There is no known exploitation of CVE-2026-45286 in the wild and no public exploit code.
Other vulnerabilities in nextcloud security-advisories
- CVE-2025-66550 Nextcloud Calendar attachments of local files are offered to downloaded
- CVE-2022-24838 Command Injection in Appointment Emails for Nextcloud Calendar
- CVE-2025-66511 Nextcloud Calendar app used predictable proposal participant tokens
- CVE-2018-3763 Cross-site scripting in Nextcloud Calendar application
- CVE-2024-37316 Nextcloud Calendar's event create can create attachments that link to other websites
Sources
Also known as GHSA-r697-74m9-gvf2.