CVE-2026-45722: Nextcloud Tables App SQL Injection Flaw

CVE-2026-45722 Overview

CVE-2026-45722 is a SQL injection vulnerability in the Nextcloud Tables app. The flaw stems from missing input sanitization in the ORDER BY clause of a database query. Authenticated users with access to the Tables app can inject SQL fragments to extract data one bit at a time or trigger time-based delays. The vulnerability affects Nextcloud Tables versions 0.9.0 through 0.9.6 and 1.0.0 through 1.0.1. Patches are available in versions 0.9.7 and 1.0.2. The issue is classified under [CWE-89] (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact
Authenticated attackers can extract sensitive database contents through blind SQL injection in the Tables app ORDER BY clause, leading to confidentiality loss and limited availability impact.

Affected Products

Nextcloud Tables app versions 0.9.0 to 0.9.6
Nextcloud Tables app versions 1.0.0 to 1.0.1
Nextcloud server instances with the Tables app enabled

Discovery Timeline

2026-06-01 - CVE-2026-45722 published to NVD
2026-06-02 - Last updated in NVD database

Technical Details for CVE-2026-45722

Vulnerability Analysis

The Nextcloud Tables app fails to sanitize user-controlled input before incorporating it into the ORDER BY portion of an SQL query. Standard parameterized queries do not protect identifiers used in ORDER BY clauses, so input must be validated against an allowlist of permitted column names and sort directions. The missing validation allows attackers to append SQL syntax that influences query execution.

Unlike injection in a WHERE clause, an ORDER BY injection cannot return arbitrary result sets directly. Attackers instead use conditional expressions or time-based payloads to infer data. Each request reveals a single bit, requiring many requests to exfiltrate complete records. The CWE-89 classification captures this class of input neutralization failure.

Root Cause

The root cause is the construction of SQL statements using unsanitized user input for the sort column or sort direction. The Tables app accepted client-supplied values and concatenated them into the query string without enforcing an allowlist. The fix in the GitHub Pull Request introduces strict validation of the ordering parameters.

Attack Vector

Exploitation requires an authenticated user account with access to the Tables app. The attacker submits crafted sort parameters through the Tables HTTP API. A typical payload uses a CASE expression that orders by a constant when a condition about a target value is true, and by a different column when false. Repeating this pattern across requests reveals data bit by bit. Alternatively, payloads invoking database sleep functions produce measurable response delays, enabling time-based blind extraction.

Refer to the GitHub Security Advisory and the HackerOne Bug Report for additional context on the exploitation pattern.

Detection Methods for CVE-2026-45722

Indicators of Compromise

HTTP requests to Tables app endpoints containing SQL keywords such as CASE, WHEN, SLEEP, BENCHMARK, or PG_SLEEP in sort parameters
Repeated requests to the same Tables endpoint from one user with incrementally varied query strings, consistent with blind extraction
Database query logs showing unusually long execution times tied to Tables app queries
High volume of ORDER BY clauses referencing unexpected expressions or subqueries

Detection Strategies

Inspect Nextcloud access logs for Tables app requests with non-alphanumeric characters in sort column parameters
Enable slow query logging on the backing database and correlate slow queries with Tables app request identifiers
Deploy a web application firewall rule that blocks SQL syntax in parameters expected to contain identifiers only

Monitoring Recommendations

Forward Nextcloud and database logs to a centralized log platform for correlation and retention
Alert on authenticated users generating bursts of Tables app requests with sort parameter variation
Track database CPU and response latency for anomalies coinciding with Tables endpoint activity

How to Mitigate CVE-2026-45722

Immediate Actions Required

Upgrade the Nextcloud Tables app to version 0.9.7 or 1.0.2 depending on the deployed branch
Audit Tables app user assignments and remove access for accounts that do not require it
Review database and Nextcloud logs for evidence of prior exploitation attempts targeting sort parameters

Patch Information

Nextcloud released fixed Tables app versions 0.9.7 and 1.0.2. The patch enforces allowlist validation of sort column and direction parameters before query construction. Administrators should install the update through the Nextcloud app store or by deploying the patched release from the GitHub Pull Request.

Workarounds

Disable the Tables app until the patched version is installed if upgrade is not immediately possible
Restrict Tables app access to a minimal set of trusted users through Nextcloud group permissions
Place a web application firewall in front of Nextcloud with rules that reject SQL metacharacters in Tables sort parameters

bash

# Upgrade the Nextcloud Tables app using occ
sudo -u www-data php occ app:update tables

# Verify the installed version meets the patched release
sudo -u www-data php occ app:list | grep -A1 tables

# Temporary mitigation: disable the Tables app
sudo -u www-data php occ app:disable tables