CVE-2026-45264: Nextcloud Privilege Escalation Flaw

CVE-2026-45264 Overview

CVE-2026-45264 is an improper access control vulnerability [CWE-284] in Nextcloud Groupfolders, the team folder application of the Nextcloud open source content collaboration platform. The flaw allows a user holding only READ and CREATE permissions, but lacking UPDATE permission, to rename files inside a team folder. This breaks the permission model that should prevent file modification by users without explicit update rights. The issue affects Groupfolders versions 17.0.0 through 21.0.3 and is fixed in 17.0.15, 18.1.12, 19.1.16, 20.1.11, and 21.0.4.

Critical Impact
An authenticated low-privilege user can rename files inside a Nextcloud team folder without holding the UPDATE permission, undermining integrity controls on shared content.

Affected Products

Nextcloud Groupfolders 17.0.0 to before 17.0.15
Nextcloud Groupfolders 18.0.0 to before 18.1.12, and 19.0.0 to before 19.1.16
Nextcloud Groupfolders 20.0.0 to before 20.1.11, and 21.0.0 to before 21.0.4

Discovery Timeline

2026-06-01 - CVE-2026-45264 published to NVD
2026-06-01 - Last updated in NVD database

Technical Details for CVE-2026-45264

Vulnerability Analysis

The vulnerability resides in the Nextcloud Groupfolders application, which provides shared team folders with per-group permission flags for READ, CREATE, UPDATE, DELETE, and SHARE. The permission check governing the rename operation does not require the UPDATE flag. A user granted only READ and CREATE rights can therefore invoke the rename action against existing files inside a team folder.

Renaming a file is logically a modification of the file's metadata and should require UPDATE permission. By accepting rename calls from users without UPDATE, Groupfolders allows authenticated low-privilege accounts to alter file names, disrupt naming conventions, and impact downstream automation that depends on consistent filenames. The fix, delivered through Nextcloud Groupfolders pull request 4361, enforces the UPDATE permission check on the rename code path.

Root Cause

The root cause is a missing authorization check on the file rename operation in Groupfolders. The permission validation routine evaluated the user's general access to the team folder but did not verify the UPDATE bit before performing the rename. This is a classic instance of [CWE-284] Improper Access Control, where one privileged action inherits the access decision of a lower-privilege action.

Attack Vector

Exploitation requires an authenticated Nextcloud account with at least READ and CREATE permissions on a team folder. The attacker issues a standard WebDAV or Nextcloud API rename request against a file inside the folder. No special tooling, social engineering, or user interaction is needed. The attack is performed over the network against the Nextcloud instance.

The vulnerability mechanism is described in the Nextcloud GitHub Security Advisory GHSA-wx2x-822r-rvmf and the corresponding Groupfolders pull request 4361. No public proof-of-concept code is required to reproduce the issue.

Detection Methods for CVE-2026-45264

Indicators of Compromise

Unexpected MOVE WebDAV requests in Nextcloud access logs originating from accounts that do not hold UPDATE permission on the target team folder.
Audit log entries showing file rename events in Groupfolders performed by users whose group permissions exclude UPDATE.
File name changes in team folders that do not correspond to actions by authorized maintainers or automated workflows.

Detection Strategies

Review Nextcloud activity logs and the Groupfolders admin audit trail for rename events, cross-referencing the acting user's permission set on the affected folder.
Enable and centralize Nextcloud audit logging, then alert on rename actions by users whose permission mask lacks the UPDATE bit.
Compare directory listings of team folders against known baselines to detect unauthorized filename changes.

Monitoring Recommendations

Forward Nextcloud nextcloud.log and audit logs to a central logging or SIEM platform for correlation across users and folders.
Track anomalous rates of MOVE operations per user, especially from accounts that historically only read or upload content.
Monitor Nextcloud version metadata across the fleet to confirm patched Groupfolders versions are deployed.

How to Mitigate CVE-2026-45264

Immediate Actions Required

Upgrade the Groupfolders app to a patched release: 17.0.15, 18.1.12, 19.1.16, 20.1.11, or 21.0.4, matching your Nextcloud major version.
Audit existing team folder permission assignments and remove CREATE rights from accounts that do not require write access.
Review recent rename activity in team folders to confirm no unauthorized changes have occurred.

Patch Information

Nextcloud released fixed Groupfolders versions 17.0.15, 18.1.12, 19.1.16, 20.1.11, and 21.0.4. The patch is implemented in Groupfolders pull request 4361 and detailed in the GHSA-wx2x-822r-rvmf advisory. Additional technical context is available in HackerOne report #3540673.

Workarounds

No official workaround exists short of upgrading. Administrators can reduce exposure by restricting CREATE permissions on team folders until the patch is applied.
Temporarily limit team folder membership to trusted users while patching is scheduled.

bash

# Update the Groupfolders app via occ after upgrading Nextcloud
sudo -u www-data php occ app:update groupfolders
sudo -u www-data php occ app:list | grep groupfolders