CVE-2026-77165 Business logic in Server
File owners cannot unlock files locked by other users, causing permanent file locks and denial of service in Nextcloud Server.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-77165?
CVE-2026-77165 is a medium-severity vulnerability in Nextcloud Server, published on 21 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
File owners were unable to unlock TYPE_TOKEN locks placed by other users, leaving files permanently locked with no recovery path outside of the database.
Weakness: CWE-284
Which versions are affected by CVE-2026-77165?
1 open source package ship an affected version, including nextcloud.
| Package | Affected | Fixed in |
|---|---|---|
nextcloud Bitnami | From 32.0.0 | 34.0.1 |
How do I fix CVE-2026-77165?
Upgrade nextcloud to 34.0.1 or later.
Is CVE-2026-77165 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-77165 exists.
Sources
Also known as BIT-nextcloud-2026-77165, GHSA-77h3-rj6p-8wj8, MINI-gg48-wpf6-3mpp.