CVE-2017-0894: Nextcloud Server

Medium severity, CVSS 4.3. EPSS: 1.2% chance of exploitation in the next 30 days.

Nextcloud Server before 11.0.3 is vulnerable to disclosure of valid share tokens for public calendars due to a logical error. Thus granting an attacker potentially access to publicly shared calendars without knowing the share token.

Affected products

• Nextcloud Nextcloud Server: before 11.0.3 (fixed in 11.0.3)

Published 2017-05-08. Last modified 2026-06-17.