CVE-2026-45544mediumCWE-1230

CVE-2026-45544: medium-severity vulnerability in nextcloud security-advisories

Nextcloud: Information Disclosure of view filter metdata via Broken Sensitive Data Masking in ViewService

Published

Follow this CVE+ Monitor security-advisories

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 4.3epss 0.2%
In short

Nextcloud Tables exposes filter criteria details to read-only users who shouldn't see them. This leaks information about how data is being filtered, which could reveal sensitive details about the database structure or filtered content.

Technical detail

CWE-1230 (Broken Sensitive Data Masking) allows read-only users in Nextcloud Tables to access view filter metadata through the ViewService, bypassing intended data protection controls. The vulnerability exists in versions 0.8.0 through 1.0.3; affected systems require upgrade to 1.0.4 or 2.0.0 to remediate the information disclosure.

Summary generated and translated by AI from the official description.
Nextcloud is an open source content collaboration platform. From version 0.8.0 to before version 1.0.4, the view filter criteria is exposed to users with read-only permissions in Nextcloud Tables. This issue has been patched in versions 1.0.4 and 2.0.0.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected products
nextcloud · security-advisories
Related CVEs — nextcloud security-advisories

In the same product, most dangerous first.

CVE-2022-24838MEDIUMCommand Injection in Appointment Emails for Nextcloud CalendarEPSS 33.0%CVE-2023-26482CRITICALScope of workflow operations is not validated in nextcloud serverEPSS 4.2%CVE-2021-32802CRITICALPreview generation used third-party library not suited for user-generated content in Nextcloud serverEPSS 2.6%CVE-2022-31014MEDIUMSMTP Command Injection in iCalendar Attachments to emails via newlines in Nextcloud ServerEPSS 2.5%CVE-2021-32688HIGHApplication specific tokens can change their own scopeEPSS 2.3%CVE-2021-37628HIGHFile Drop can be bypassed using Richdocuments app in nextcloudEPSS 2.1%