Skip to content
Nextcloud ACL Rename Permission Bypass Vulnerability Disclosed

Nextcloud ACL Rename Permission Bypass Vulnerability Disclosed

First seen 1 Jun 2026, 22:24 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •June 2, 2026 at 22:12 UTC
  • •CVE-2026-45264 allows unauthorized file renaming in Nextcloud team folders.
  • •Affected versions include Nextcloud 17.0.0 to 21.0.3; patches are available.
  • •The vulnerability has a CVSS score of 4.3, indicating medium severity.

A new vulnerability, CVE-2026-45264, has been identified in Nextcloud, an open-source content collaboration platform. This flaw affects versions 17.0.0 to before 17.0.15, 18.0.0 to before 18.1.12, 19.0.0 to before 19.1.16, 20.0.0 to before 20.1.11, and 21.0.0 to before 21.0.4. Users with READ and CREATE permissions, but lacking UPDATE permissions, can rename files in team folders, potentially leading to unauthorized file modifications. The vulnerability has been assigned a CVSS score of 4.3, indicating a medium severity level. Patches have been released in versions 17.0.15, 18.1.12, 19.1.16, 20.1.11, and 21.0.4. Organizations using affected versions are advised to update immediately to mitigate risks. The issue was published on June 1, 2026, and has been reported across multiple cybersecurity platforms.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 111d ago How this analysis works

Timeline

2026-06-01
CVE-2026-45264 published
Nextcloud vulnerability disclosed, allowing unauthorized file renaming by users with limited permissions.
cve.threatint.eu
2026-06-01
Patches released for affected versions
Nextcloud released updates for versions 17.0.15, 18.1.12, 19.1.16, 20.1.11, and 21.0.4 to address the vulnerability.
Feedly
2026-06-01
CVSS score assigned
The vulnerability received a CVSS score of 4.3, categorizing it as medium risk.
exploit-intel.com

More articles in this cluster (6)

Following this threat?

Track CVE-2026-45264 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (7)

1 / 3