Nextcloud Server up to 32.0.1/33.0.0 files_lock App improper authentication

Summaryinfo

A vulnerability, which was classified as critical, has been found in Nextcloud Server up to 32.0.1/33.0.0. Affected by this issue is some unknown functionality of the component files_lock App. This manipulation causes improper authentication. This vulnerability appears as CVE-2026-45283. The attack may be initiated remotely. There is no available exploit. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability has been found in Nextcloud Server up to 32.0.1/33.0.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the component files_lock App. The manipulation with an unknown input leads to a improper authentication vulnerability. The CWE definition for the vulnerability is CWE-287. When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.2, and 33.0.0 to before 33.0.1, the files_lock app did not properly validate the ownership of files when processing DAV lock and unlock requests. An authenticated user could lock or unlock files belonging to other users by targeting their absolute WebDAV paths. Additionally, lock tokens were disclosed to unauthorized callers in error responses, allowing attackers to remove token-based locks placed by other users' client applications. It is recommended that the Nextcloud Server is upgraded to 32.0.2 or 33.0.1. It is recommended that the Nextcloud Enterprise Server is upgraded to 31.0.14.4 or 32.0.2 or 33.0.1

The advisory is shared at github.com. This vulnerability is known as CVE-2026-45283 since 05/11/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Neither technical details nor an exploit are publicly available.

Upgrading to version 32.0.2 or 33.0.1 eliminates this vulnerability. Applying a patch is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-33708). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Cloud Software

Vendor

• Nextcloud

Name

• Server

Version

• 32.0.0
• 32.0.1
• 33.0

License

• open-source

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion