CVE-2026-45281: Nextcloud: Cross-Account Calendar Takeover via Unauthorized Group-Member-Set Update
Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, with the knowledge of other users’ principal URL an attacker could possibly send a request to gain full access to their calendar. Therefore, the attacker must be an authenticated user. This is because of improper authorization controls in the backend of the calendar. If the attacker had access to the calendar, they would be able to view and modify it. It is recommended that the Nextcloud Server is upgraded to 33.0.3 or 32.0.9. It is recommended that the Nextcloud Enterprise Server is upgraded to 33.0.3, 32.0.9, 31.0.14.5, 30.0.17.9, 29.0.16.16, 28.0.14.17, 27.1.11.26, 26.0.13.26, 25.0.13.29, 24.0.12.34, 23.0.12.35, 22.2.10.39, or 21.0.9.23
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 33.0.3 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 32.0.9 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 31.0.14.5 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 30.0.17.9 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 29.0.16.16 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 28.0.14.17 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 27.1.11.26 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 26.0.13.26 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 25.0.13.29 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 24.0.12.34 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 23.0.12.35 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 22.2.10.39 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 21.0.9.23
Event History
Frequently Asked Questions
What is the severity of CVE-2026-45281?
CVE-2026-45281 has a severity score of 8.1, indicating a high risk level.
How do I fix CVE-2026-45281?
To fix CVE-2026-45281, apply the latest patches provided by Nextcloud for the affected versions.
What systems are affected by CVE-2026-45281?
CVE-2026-45281 affects Nextcloud Server from versions 32.0.0 to before 32.0.9 and 33.0.0 to before 33.0.3.
What kind of attack is possible with CVE-2026-45281?
CVE-2026-45281 allows an attacker to execute a cross-account calendar takeover if they know another user's principal URL.
Is there a security risk in using Nextcloud versions with CVE-2026-45281?
Yes, using affected Nextcloud versions poses a high security risk as unauthorized access to user calendars is possible.