CVE-2026-77166 Business logic in Collectives
Attackers can break the sidebar layout by injecting long text into the emoji field, potentially hiding other interface items.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-77166?
CVE-2026-77166 is a low-severity vulnerability in Nextcloud Collectives, published on 21 Sep 2026. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
The emoji field in the page emoji update endpoint does not properly validate user input. By injecting long text and line breaks, the sidebar layout becomes broken and can hide other items.
Weakness: CWE-840
Which versions are affected by CVE-2026-77166?
How do I fix CVE-2026-77166?
No fix has been published for CVE-2026-77166 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-77166 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-77166 exists.
Sources
Also known as GHSA-8gq2-j3j2-95vm.