CVE-2026-45267: Nextcloud Information Disclosure Flaw

CVE-2026-45267 Overview

CVE-2026-45267 is an information disclosure vulnerability in Nextcloud Forms, an open source content collaboration platform component. A missing permissions check in versions prior to 5.2.6 allows authenticated users to request and read form submissions belonging to other users. The flaw is classified under [CWE-200] (Exposure of Sensitive Information to an Unauthorized Actor). Nextcloud patched the issue in Forms version 5.2.6.

Critical Impact
Authenticated low-privilege users can retrieve form submissions of other users, exposing potentially sensitive survey, registration, or feedback data collected through Nextcloud Forms.

Affected Products

Nextcloud Forms versions prior to 5.2.6
Nextcloud instances with the Forms application enabled
Self-hosted and managed Nextcloud deployments using vulnerable Forms releases

Discovery Timeline

2026-06-01 - CVE-2026-45267 published to the National Vulnerability Database
2026-06-01 - Last updated in NVD database

Technical Details for CVE-2026-45267

Vulnerability Analysis

The vulnerability resides in the Nextcloud Forms application, which lets users build and share forms for data collection. Submissions are stored server-side and tied to the form owner and authorized collaborators. Before version 5.2.6, the API endpoint that returns submission data did not consistently verify that the calling user held read permissions on the target form. An authenticated user could therefore issue a request referencing another user's form and receive its stored submissions in response. The exposure is limited to confidentiality, since data integrity and availability are not affected by the flaw. The Forms application is widely deployed across Nextcloud installations for HR surveys, event registrations, and customer feedback, making the submissions a useful target for an internal attacker.

Root Cause

The root cause is a missing authorization check on the submissions retrieval path within the Forms backend. The handler accepted a submission or form identifier from the request and returned data without enforcing that the requester was the form owner, a shared collaborator, or otherwise entitled to view results. The upstream fix, delivered in Nextcloud Forms pull request #3269, introduces the missing permission check so that submission access requires an authorization verification step before data is returned.

Attack Vector

Exploitation requires network access to the Nextcloud instance and valid user credentials, but no user interaction from the victim. An attacker with any authenticated Nextcloud account can call the Forms submissions API and reference a form they do not own. Because the access check was absent, the server returns the submissions of the targeted form. Details of the proof-of-concept are tracked in HackerOne report #3628817 and the Nextcloud security advisory GHSA-r4gh-f8x6-m55f.

No verified public exploit code is available. See the security advisory for technical details on the vulnerable endpoint and the patched authorization logic.

Detection Methods for CVE-2026-45267

Indicators of Compromise

Unexpected access entries in Nextcloud audit logs showing users reading Forms submissions for forms they do not own or collaborate on.
Repeated enumeration of sequential form or submission identifiers from a single authenticated account.
API requests to Forms submissions endpoints originating from accounts with no business need to access Forms data.

Detection Strategies

Review Nextcloud nextcloud.log and audit logs for Forms submission read operations correlated against form ownership and sharing metadata.
Alert on accounts that query a high number of distinct form identifiers within a short window, which indicates enumeration.
Compare the authenticated user identifier in Forms API requests against the form owner and share list to flag mismatches.

Monitoring Recommendations

Ingest Nextcloud webserver and application logs into a centralized log platform and build queries that surface Forms submission access by non-owners.
Track Forms application version across all Nextcloud nodes to confirm every instance is running 5.2.6 or later.
Monitor for new accounts that immediately begin accessing Forms endpoints, which may indicate abuse by a low-privileged insider.

How to Mitigate CVE-2026-45267

Immediate Actions Required

Upgrade the Nextcloud Forms application to version 5.2.6 or later on all Nextcloud instances.
Audit existing form submissions for sensitive data and notify form owners if unauthorized access is suspected.
Restrict Forms application access to users with a legitimate business need until the patch is deployed.
Review authentication logs for unusual API activity targeting Forms endpoints prior to patching.

Patch Information

Nextcloud released Forms version 5.2.6, which adds the missing permissions check before returning submission data. The code change is documented in Nextcloud Forms pull request #3269, and the coordinated disclosure is published as GHSA-r4gh-f8x6-m55f. Administrators should update through the Nextcloud App Store or by deploying the patched release via their configuration management tooling.

Workarounds

Disable the Forms application from the Nextcloud admin console until the upgrade to 5.2.6 can be applied.
Limit Forms usage to a trusted group through Nextcloud group restrictions on the application.
Remove or archive forms containing sensitive submissions until the patched version is deployed.

bash

# Upgrade Nextcloud Forms to the patched version using occ
sudo -u www-data php occ app:update forms
sudo -u www-data php occ app:list | grep forms
# Confirm the installed version reports 5.2.6 or later