Back Linuxsecurity

Fedora 43 Nextcloud 33.0.5 Major Security Advisory on Authentication Bypass

Linuxsecurity •LinuxSecurity Advisories • June 17, 2026

[ 1 ] Bug #2483840 - CVE-2026-45690 nextcloud: Nextcloud Server: Authentication bypass allows unauthorized access by circumventing two-factor authentication. [epel-all] [ 2 ] Bug #2483841 - CVE-2026-45690 nextcloud: Nextcloud Server: Authentication bypass allows unauthorized access by circumventing two-factor authentication. [fedora-all] [ 3 ] Bug #2483842 - CVE-2026-45810 nextcloud: Nextcloud Server: Information disclosure via missing relation check in file [epel-all] [ 4 ] Bug #2483843 - CVE-2026-45285 nextcloud: Nextcloud: Unauthorized data access and modification via unlisted public links [fedora-all] [ 5 ] Bug #2483844 - CVE-2026-45691 nextcloud: Nextcloud Server: Two-factor authentication bypass via session cookie ...

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-cb3feafe41' at the command line. For more information, refer to the dnf documentation available at

Get the latest Linux and open source security news straight to your inbox.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Authentication Bypass Vulnerabilities in Nextcloud for Fedora 44 On June 17, 2026, Fedora released a security advisory for Nextcloud version 33.0.5, addressing multiple vulnerabilities. Key issues include CVE-2026-45690, an authentication bypass that allows unauthorized access by circumventing two-factor authentication. Other vulnerabilities include CVE-2026-45810, which enables information disclosure, and CVE-2026-45285, allowing unauthorized data access via unlisted public links. The vulnerabilities affect both Fedora and EPEL repositories. Users are urged to apply the updates immediately to mitigate risks. The advisory provides installation instructions using the 'dnf' update program. The vulnerabilities were published on June 1, 2026, indicating they have been known for a short period but could still pose significant risks if not addressed promptly. 2 sources 71

Extracted Entities

Fedora 43 Nextcloud 33.0.5 Major Security Advisory on Authentication Bypass

The full story

Extracted Entities

Attack Types (1)

Companies (1)

CVEs (4)

CWE Weaknesses (3)

Platforms (2)