4.3Medium
CVE-2026-45544Nextcloud: Information Disclosure of view filter metdata via Broken Sensitive Data Masking in ViewService
Description
Nextcloud is an open source content collaboration platform. From version 0.8.0 to before version 1.0.4, the view filter criteria is exposed to users with read-only permissions in Nextcloud Tables. This issue has been patched in versions 1.0.4 and 2.0.0.
Weakness (CWE):
CWE-1230
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
Affected products and versions
| Vendor | Product | Versions | |
|---|---|---|---|
| nextcloud | security-advisories | >= 0.8.0, < 1.0.4 | |
| nextcloud | tables | 0.8.0 – < 1.0.4 |
References and patches
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-vvxm-6jjp-m9mp MitigationVendor Advisory
- https://github.com/nextcloud/tables/pull/2312 Issue TrackingPatch
- https://hackerone.com/reports/3483753
CPE matches (NVD) (1)
cpe:2.3:a:nextcloud:tables:*:*:*:*:*:nextcloud:*:*≥ 0.8.0 < 1.0.4