IP-DB.com
Türkçe English Deutsch Español
Log In Get API Key
6.5Medium

CVE-2026-77165

Nextcloud Server Published: (1 month ago)

Description

File owners were unable to unlock TYPE_TOKEN locks placed by other users, leaving files permanently locked with no recovery path outside of the database.

Weakness (CWE): CWE-284

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

VendorProductVersions
Nextcloud Server 32.0.0 – ≤ 34.0.0

References and patches

Recent CVEs in the same product — Nextcloud

7.5High
CVE-2026-77167
Nextcloud server

Abusing the federated share endpoint, an attacker can write arbitrary rows into the oc_share_external database table. These rows persist indefinitely — there is no automatic cleanup mechanism. Three distinct denial-of-service conditions follow from this write…

5.3Medium
CVE-2026-77172
Nextcloud Server

App passwords were allowed to bypass password confirmation on sensitive endpoints.

4.3Medium
CVE-2026-82984
Nextcloud Server

When a team was configured as "visible to everyone", the web UI correctly blocked non-members from viewing the team ("You are not a member of ..."), but the resources API endpoint could still be called directly, allowing any authenticated non-member to enumer…

3.1Low
CVE-2026-68493
Nextcloud Server

After guessing a 62^15 complex unique identifier, a malicious logged in user was able to retrieve a list of memberships for a circle they are not a member of.

6.2Medium
CVE-2026-77164
Nextcloud Server

Circles' remote-instance signature verification fetches the attacker-supplied keyId URL before trust in the remote instance is established, and explicitly allows local/private addresses for this request, bypassing Nextcloud's core SSRF protections. The public…

6.5Medium
CVE-2026-82985
Nextcloud Server

The Photos app's filter-based "smart albums" build their file listing using the search configuration (photosSourceFolders) of the user viewing the album, rather than the album owner's configuration. When an album owner shares a smart album with another user, …