CVE-2026-45264: Nextcloud: ACL Rename Permission Bypass in Team Folders Allows Unauthorized File Renames
Nextcloud is an open source content collaboration platform. From versions 17.0.0 to before 17.0.15, 18.0.0 to before 18.1.12, 19.0.0 to before 19.1.16, 20.0.0 to before 20.1.11, and 21.0.0 to before 21.0.4, a user with READ and CREATE permission, but no UPDATE permission for a team folder can rename files in the team folder. This issue has been patched in versions 17.0.15, 18.1.12, 19.1.16, 20.1.11, and 21.0.4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
nextcloudto a version that resolves this vulnerability.Fixed in 17.0.15 - Upgrade
Upgrade
nextcloudto a version that resolves this vulnerability.Fixed in 18.1.12 - Upgrade
Upgrade
nextcloudto a version that resolves this vulnerability.Fixed in 19.1.16 - Upgrade
Upgrade
nextcloudto a version that resolves this vulnerability.Fixed in 20.1.11 - Upgrade
Upgrade
nextcloudto a version that resolves this vulnerability.Fixed in 21.0.4
Event History
Frequently Asked Questions
What is the severity of CVE-2026-45264?
The severity of CVE-2026-45264 is medium with a score of 4.3.
How do I fix CVE-2026-45264?
To fix CVE-2026-45264, you should upgrade Nextcloud to versions 17.0.15, 18.1.12, 19.1.16, 20.1.11, or 21.0.4 or later.
What does CVE-2026-45264 exploit?
CVE-2026-45264 exploits a permission bypass in Nextcloud's team folders allowing unauthorized file renames.
Which versions of Nextcloud are affected by CVE-2026-45264?
CVE-2026-45264 affects Nextcloud versions 17.0.0 to before 17.0.15, 18.0.0 to before 18.1.12, 19.0.0 to before 19.1.16, 20.0.0 to before 20.1.11, and 21.0.0 to before 21.0.4.
What permissions are required to exploit CVE-2026-45264?
To exploit CVE-2026-45264, an attacker needs READ and CREATE permissions but lacks UPDATE permission in a team folder.