CVE-2026-45154: Nextcloud Information Disclosure Flaw

CVE-2026-45154 Overview

CVE-2026-45154 is an improper access control vulnerability [CWE-284] in the Nextcloud Collectives application. The flaw affects versions from 2.6.0 up to but not including 4.3.0. When a page in a collective was deleted and that collective was shared in view-only mode, guests retained the ability to access the deleted pages directly through the trashbin. The issue results in unauthorized read access to content that owners intended to remove from guest visibility. Nextcloud patched the issue in Collectives version 4.3.0.

Critical Impact
Guest users with view-only access to a shared Nextcloud collective can read deleted pages through the trashbin, bypassing the intended access boundary for removed content.

Affected Products

Nextcloud Collectives versions 2.6.0 through 4.2.x
Nextcloud instances sharing collectives in view-only mode with guests
Nextcloud Collectives version 4.3.0 and later are not affected

Discovery Timeline

2026-06-01 - CVE-2026-45154 published to NVD
2026-06-01 - Last updated in NVD database

Technical Details for CVE-2026-45154

Vulnerability Analysis

The vulnerability resides in the Nextcloud Collectives application, a content collaboration tool for shared documentation. Collectives can be shared with guests in view-only mode, which is intended to restrict guests to currently published content. The application exposes a trashbin where deleted pages are retained before permanent removal. The access control checks for the trashbin endpoint did not enforce the view-only sharing boundary against guests. Consequently, any guest who knew or discovered a deleted page could open it through the trashbin interface and read its contents.

The weakness aligns with CWE-284: Improper Access Control. Successful exploitation results in confidentiality impact only, with no modification or denial of service. The attack requires an authenticated guest session and user interaction to navigate the trashbin.

Root Cause

The root cause is a missing authorization check on the trashbin retrieval logic within the Collectives application. The component did not validate whether the requesting guest had write permissions before serving deleted page content. View-only guests were treated equivalently to collective members for trashbin access. The fix in pull request nextcloud/collectives#2432 restricts trashbin access to users with appropriate edit privileges.

Attack Vector

An attacker must first obtain guest access to a Nextcloud collective shared in view-only mode. The attacker then navigates to the collective's trashbin view and reads pages that the owner previously deleted. No special tooling, privilege escalation, or chained exploit is required. The attack relies on the application surfacing deleted content to a principal that should not see it.

No synthetic exploitation code is provided. Refer to the GitHub Security Advisory GHSA-8mpv-ggq8-hf3w and HackerOne Report #3521434 for additional technical context.

Detection Methods for CVE-2026-45154

Indicators of Compromise

Web server access logs showing guest sessions issuing GET requests to Collectives trashbin endpoints such as /apps/collectives/_api/.../trash
Repeated trashbin enumeration by guest accounts associated with view-only collective shares
Access patterns where guest principals retrieve page identifiers that have been marked deleted

Detection Strategies

Audit Nextcloud application logs for trashbin route access correlated with guest session tokens on view-only shares
Review Collectives database tables for read access events targeting deleted page records by non-owner accounts
Compare the list of guest accounts with access to collectives against trashbin activity in HTTP logs

Monitoring Recommendations

Forward Nextcloud audit logs and web server access logs to a centralized logging platform for retention and query
Create alerts on anomalous guest activity, particularly trashbin endpoint access following page deletion events
Track the installed version of the Collectives application across Nextcloud deployments to confirm patched status

How to Mitigate CVE-2026-45154

Immediate Actions Required

Upgrade the Nextcloud Collectives application to version 4.3.0 or later through the Nextcloud App Store or occ command line
Inventory all collectives currently shared with guests in view-only mode and review their trashbin contents
Permanently purge sensitive deleted pages from the trashbin if they may have been exposed prior to patching

Patch Information

The vendor fix is delivered in Nextcloud Collectives 4.3.0. The corresponding code change is available in GitHub Pull Request #2432. Administrators should update the Collectives app independently of the Nextcloud Server release cycle, as app updates are distributed through the Nextcloud App Store.

Workarounds

Revoke guest access to affected collectives until the Collectives application is upgraded to 4.3.0
Empty the trashbin of each collective shared in view-only mode to remove residual deleted content from guest visibility
Convert sensitive view-only guest shares to authenticated member shares with explicit access reviews until patching is complete

bash

# Upgrade the Collectives app via occ on the Nextcloud server
sudo -u www-data php occ app:update collectives
sudo -u www-data php occ app:list | grep collectives