CVE-2026-45155: Nextcloud Server Auth Bypass Vulnerability

CVE-2026-45155 Overview

CVE-2026-45155 is a low-severity access control vulnerability in the Nextcloud Server Circles component. The flaw stems from a missing access check at the API level that allowed unknown circles to be added directly to other circles by their ID. The issue affects Nextcloud Server versions 32.0.0 through 32.0.6 and 33.0.0. An attacker who obtains a valid circle ID through another channel can use this gap to track circle memberships. The vulnerability is classified under [CWE-639] (Authorization Bypass Through User-Controlled Key).

Critical Impact
An authenticated user with knowledge of a circle ID can enumerate membership information of arbitrary circles, leading to unauthorized exposure of group association data.

Affected Products

Nextcloud Server versions 32.0.0 to before 32.0.7
Nextcloud Server versions 33.0.0 to before 33.0.1
Nextcloud Enterprise Server versions 29.0.x, 30.0.x, 31.0.x, 32.0.x, and 33.0.x prior to the fixed releases

Discovery Timeline

2026-06-01 - CVE-2026-45155 published to NVD
2026-06-01 - Last updated in NVD database

Technical Details for CVE-2026-45155

Vulnerability Analysis

The vulnerability resides in the Nextcloud Circles application, which provides group collaboration functionality. The API endpoint responsible for adding a circle as a member of another circle does not perform an authorization check verifying that the calling user has visibility into the target circle. As a result, an authenticated attacker can supply the ID of an unknown circle and add it to a circle they control. After insertion, the relationship reveals whether the supplied ID corresponds to a valid circle and exposes membership metadata.

Exploitation requires user interaction and elevated attack complexity, which limits practical impact. The confidentiality impact is limited to membership association data rather than file contents.

Root Cause

The root cause is a missing access check on the API handler that processes circle-to-circle membership additions. The handler trusts the supplied circle ID without confirming that the caller is permitted to reference it. This pattern matches [CWE-639], where authorization decisions rely on a user-controlled identifier without verifying the requester's relationship to the referenced object.

Attack Vector

The attack requires network access and an authenticated session on the target Nextcloud instance. Circle IDs use 62^15 entropy by default, so blind enumeration is not feasible. The attack becomes practical only when the attacker has obtained a circle ID through a separate channel such as log exposure, shared links, or insider knowledge. The attacker then issues an API request adding the target circle ID as a sub-circle of a circle they own. The response and subsequent membership listings reveal information about the target circle's members.

No public proof-of-concept exploit is available. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. See the GitHub Security Advisory and HackerOne Report #3511998 for additional technical detail.

Detection Methods for CVE-2026-45155

Indicators of Compromise

Unexpected entries in the circle_circle membership table linking unrelated circles
API requests to circle membership endpoints referencing circle IDs that the requesting user has no prior interaction history with
Audit log entries showing circle additions performed by users who are not members of the target circle

Detection Strategies

Review Nextcloud audit logs for circle membership modifications and correlate the actor with prior access to the referenced circle ID
Inspect database state for sub-circle relationships that cross organizational or tenant boundaries
Compare snapshots of the circles tables before and after suspicious time windows to detect unauthorized nesting

Monitoring Recommendations

Enable verbose logging on the Circles application and forward events to a centralized log platform for retention and search
Alert on high-frequency circle membership API calls from a single account, which may indicate enumeration attempts
Monitor for access by accounts to circle IDs that appear in external sources such as exported documents or shared links

How to Mitigate CVE-2026-45155

Immediate Actions Required

Upgrade Nextcloud Server to version 32.0.7 or 33.0.1 as soon as practical
Upgrade Nextcloud Enterprise Server to 29.0.16.14, 30.0.17.8, 31.0.14.3, 32.0.7, or 33.0.1 depending on the deployed branch
Audit existing circle relationships for unexpected nested memberships and remove unauthorized entries

Patch Information

The fix is delivered in Nextcloud Server 32.0.7 and 33.0.1, and in Nextcloud Enterprise Server releases 29.0.16.14, 30.0.17.8, 31.0.14.3, 32.0.7, and 33.0.1. The corrective change adds an access check on the circle membership API path. See the GitHub Pull Request for the code-level remediation.

Workarounds

Restrict use of the Circles application to trusted user populations until the upgrade is applied
Avoid distributing or logging raw circle IDs in any channel where unauthorized users might observe them
Reduce log retention or redact circle identifiers from exported logs to limit the supply of usable IDs to potential attackers

bash

# Upgrade example using the Nextcloud updater
sudo -u www-data php /var/www/nextcloud/updater/updater.phar
sudo -u www-data php /var/www/nextcloud/occ upgrade
sudo -u www-data php /var/www/nextcloud/occ status