CVE-2026-45545 Overview
CVE-2026-45545 is a stored SQL injection vulnerability in the Nextcloud Tables application. An authenticated attacker with access to the Tables app can execute arbitrary SQL queries up to 20 bytes long through injected input. Carefully crafted payloads allow attackers to break out of the length restriction. The flaw maps to [CWE-89] (Improper Neutralization of Special Elements used in an SQL Command).
The vulnerability affects multiple release branches of the Tables app and has been patched upstream. Successful exploitation enables attackers to extract or modify database contents within the Nextcloud instance.
Critical Impact
Authenticated attackers can read and modify backend database records through stored SQL injection in the Nextcloud Tables app, compromising data confidentiality and integrity.
Affected Products
- Nextcloud Tables app versions 0.7.0 through 0.7.6
- Nextcloud Tables app versions 0.8.0 through 0.8.9, and 0.9.0 through 0.9.7
- Nextcloud Tables app versions 1.0.0 through 1.0.3
Discovery Timeline
- 2026-06-01 - CVE-2026-45545 published to NVD
- 2026-06-02 - Last updated in NVD database
Technical Details for CVE-2026-45545
Vulnerability Analysis
The Nextcloud Tables app stores and queries user-defined tabular data inside the Nextcloud backend database. The vulnerable code path accepts user-supplied input destined for SQL statements without sufficient sanitization or parameterization. The Tables app constrains the injected segment to 20 bytes, which initially appears to limit attacker control.
Researchers demonstrated that a crafted payload can escape this length restriction and produce a stored SQL injection primitive. Because the injection is stored, payloads persist in the database and execute when later queries reference the affected records. Authentication is required, but any user with access to the Tables app qualifies. The result is unauthorized data extraction or modification across rows the underlying database user can reach.
Root Cause
The root cause is improper neutralization of special elements in SQL commands [CWE-89]. The Tables app concatenates attacker-controlled values into SQL statements rather than binding them as parameters. The 20-byte truncation acted as a fragile safeguard rather than a structural defense, and bounded-length input still produces valid injection syntax.
Attack Vector
An authenticated user with Tables app access submits crafted input through a table field that the application later embeds into a SQL query. The payload uses compact SQL syntax that fits within the 20-byte window while still altering query semantics. Subsequent server-side queries execute the injected SQL under the Nextcloud database user's privileges, returning or mutating data outside the attacker's intended scope.
No exploit code is publicly available for this issue. Refer to the GitHub Security Advisory, the upstream patch pull request, and the HackerOne report for technical details.
Detection Methods for CVE-2026-45545
Indicators of Compromise
- Unexpected rows, columns, or values inside Nextcloud Tables records, particularly entries containing SQL keywords such as UNION, SELECT, --, or stacked statement separators.
- Database query logs showing malformed or unusually structured statements originating from the Tables app service account.
- Outbound data transfers or bulk row reads from the Nextcloud database that do not correspond to normal Tables usage patterns.
Detection Strategies
- Inspect the oc_tables_* database tables for cell values containing SQL meta-characters or fragments resembling injection payloads.
- Enable and review Nextcloud audit logs for Tables app actions performed by accounts that recently created or modified rows with suspicious content.
- Correlate web server access logs with Tables API endpoints to identify users issuing high volumes of row writes shortly before anomalous database activity.
Monitoring Recommendations
- Forward Nextcloud application logs and database query logs to a centralized logging platform for retention and analysis.
- Alert on authenticated Tables app users generating database errors at elevated rates, which often accompany injection probing.
- Track installed Nextcloud Tables app versions across instances and flag any deployment running a release earlier than the patched versions.
How to Mitigate CVE-2026-45545
Immediate Actions Required
- Upgrade the Nextcloud Tables app to version 0.7.7, 0.8.10, 0.9.8, 1.0.4, or 2.0.0 depending on the current branch.
- Audit Tables app user accounts and revoke access for users who do not require the functionality.
- Review recent Tables app row contents and database state for evidence of injection or unauthorized modification.
Patch Information
The Nextcloud project addressed the vulnerability in Tables app versions 0.7.7, 0.8.10, 0.9.8, 1.0.4, and 2.0.0. The fix is described in the upstream pull request and the GitHub Security Advisory GHSA-x43f-gmgh-vvjj.
Workarounds
- Disable the Tables app until the patched version can be installed if upgrading immediately is not possible.
- Restrict Tables app access to a minimal set of trusted users through Nextcloud group policies while patching is scheduled.
- Restore from a known-good database backup if evidence of exploitation is observed after upgrading.
# Upgrade the Nextcloud Tables app via occ to the patched release
sudo -u www-data php occ app:update tables
sudo -u www-data php occ app:list | grep tables
# Temporary workaround: disable the Tables app until patched
sudo -u www-data php occ app:disable tables
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
