CVE-2026-45159 Overview
CVE-2026-45159 is an authorization flaw in the Nextcloud end_to_end_encryption application. A malicious user with access to an end-to-end encrypted files drop link can write files into other end-to-end encrypted folders owned by the share owner. The flaw does not permit reading or modifying existing files, limiting impact to unauthorized writes. The issue is classified under [CWE-639] Authorization Bypass Through User-Controlled Key. Patches are available in versions 1.15.4, 1.16.3, 1.17.1, 1.18.1, and 2.0.0-rc.7.
Critical Impact
Authenticated attackers with a valid file drop link can place arbitrary files into unrelated end-to-end encrypted folders belonging to the share owner.
Affected Products
- Nextcloud end_to_end_encryption versions 1.15.0 to before 1.15.4
- Nextcloud end_to_end_encryption versions 1.16.0 to before 1.16.3, and 1.17.0 to before 1.17.1
- Nextcloud end_to_end_encryption versions 1.18.0 to before 1.18.1
Discovery Timeline
- 2026-06-01 - CVE-2026-45159 published to NVD
- 2026-06-01 - Last updated in NVD database
Technical Details for CVE-2026-45159
Vulnerability Analysis
The vulnerability resides in Nextcloud's end_to_end_encryption server application, which manages encrypted file drops between sharers and recipients. A file drop link is intended to grant a recipient write-only access to a single designated encrypted folder. The application failed to validate that the target folder referenced during an upload matched the folder authorized by the drop link. An authenticated user holding a valid drop link could therefore reference other end-to-end encrypted folders owned by the share owner and place files there. According to the advisory, reading or modifying existing files was not possible, so the impact is constrained to unauthorized file creation in unintended locations.
Root Cause
The root cause is an authorization check that trusted a user-controlled folder identifier instead of binding the upload to the folder authorized by the drop link. This pattern matches [CWE-639] Authorization Bypass Through User-Controlled Key. The fix, introduced in Nextcloud pull request 1395, enforces that the upload target matches the folder associated with the drop link share.
Attack Vector
The attacker must possess a valid file drop link to an end-to-end encrypted folder owned by the victim. Using that authenticated context, the attacker submits an upload request that references a different end-to-end encrypted folder identifier belonging to the same share owner. The server processes the upload against the attacker-supplied folder reference rather than the link-bound folder. The attack requires network access, low privileges, and user interaction tied to share link usage, consistent with the published CVSS vector. No exploit code is publicly available, and the issue is not listed in CISA KEV.
Detection Methods for CVE-2026-45159
Indicators of Compromise
- Unexpected files appearing inside end-to-end encrypted folders that were not shared via file drop links.
- Server access logs showing upload requests from drop link sessions targeting folder identifiers that differ from the link-bound folder.
- Audit log entries where the uploader account does not match any user with explicit share permissions on the destination folder.
Detection Strategies
- Review Nextcloud audit logs for end_to_end_encryption upload activity and correlate share token, source user, and destination folder ID.
- Alert when a single drop link session writes to multiple distinct encrypted folder IDs within a short window.
- Cross-reference uploaded file metadata against expected drop link destinations to surface mismatches.
Monitoring Recommendations
- Ingest Nextcloud application and access logs into a centralized log platform with retention sufficient to investigate share-link abuse.
- Track installed end_to_end_encryption app versions across all Nextcloud instances to confirm patched builds are deployed.
- Monitor for new external references or proof-of-concept publications tied to GHSA-p3qw-7gwx-wg24.
How to Mitigate CVE-2026-45159
Immediate Actions Required
- Upgrade the Nextcloud end_to_end_encryption app to 1.15.4, 1.16.3, 1.17.1, 1.18.1, or 2.0.0-rc.7 depending on the deployed branch.
- Audit recent uploads in end-to-end encrypted folders and remove files that cannot be attributed to authorized share recipients.
- Rotate or revoke existing file drop links if abuse is suspected during the vulnerable window.
Patch Information
The fix is delivered via Nextcloud pull request 1395 and documented in GitHub Security Advisory GHSA-p3qw-7gwx-wg24. Additional reporter details are available in HackerOne Report #3304830. Administrators should update the end_to_end_encryption app through the Nextcloud app management interface or by deploying the patched release artifact.
Workarounds
- Temporarily disable file drop links on end-to-end encrypted folders until the patched app version is deployed.
- Restrict the end_to_end_encryption app to a limited group of trusted users to reduce exposure during patch rollout.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
