CVE-2026-68493 Information disclosure in Server
A malicious logged-in user can retrieve membership lists for circles they do not belong to by guessing unique identifiers.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-68493?
CVE-2026-68493 is a low-severity vulnerability in Nextcloud Server, published on 18 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
After guessing a 62^15 complex unique identifier, a malicious logged in user was able to retrieve a list of memberships for a circle they are not a member of.
Weakness: CWE-639
Which versions are affected by CVE-2026-68493?
1 open source package ship an affected version, including nextcloud.
| Package | Affected | Fixed in |
|---|---|---|
nextcloud Bitnami | From 32.0.0 | 34.0.1 |
How do I fix CVE-2026-68493?
Upgrade nextcloud to 34.0.1 or later.
Is CVE-2026-68493 being exploited?
There is no known exploitation of CVE-2026-68493 in the wild and no public exploit code.
Sources
Also known as BIT-nextcloud-2026-68493, GHSA-f3xf-5g94-7q62, MINI-m4jm-w3p4-j49c.