CVE-2026-45154: Nextcloud Security-Advisories

Low severity, CVSS 2.6. EPSS: 0.3% chance of exploitation in the next 30 days.

Nextcloud is an open source content collaboration platform. From version 2.6.0 to before version 4.3.0, when a previous collective pages was deleted and the collective was shared view-only, guests with access to the collective were able to access the deleted pages directly from the trashbin. This issue has been patched in version 4.3.0.

Affected products

• Nextcloud Security-Advisories: from 2.6.0, before 4.3.0 (fixed in 4.3.0)

Published 2026-06-01. Last modified 2026-07-22.