CVE-2026-45545

Nextcloud is an open source content collaboration platform. From versions 0.7.0 to before 0.7.7, 0.8.0 to before 0.8.10, 0.9.0 to before 0.9.8, and 1.0.0 to before 1.0.4, an authenticated attacker with access to the Tables app may be able to execute arbitrary up to 20 bytes long SQL queries, through a stored injection. With carefully crafted input it is possible to break out of the length limitation. The attacker could use this to extract information from the database, or modify data. This issue has been patched in versions 0.7.7, 0.8.10, 0.9.8, 1.0.4, and 2.0.0.

CVSS v3 8.2 HIGH

8.2^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.8

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-x43f-gmgh-vvjj	Mitigation Vendor Advisory
https://github.com/nextcloud/tables/pull/2309	Issue Tracking Patch
https://hackerone.com/reports/3462991	Permissions Required

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:nextcloud:tables::::::nextcloud::*
	cpe:2.3:a:nextcloud:tables::::::nextcloud::*
	cpe:2.3:a:nextcloud:tables::::::nextcloud::*
	cpe:2.3:a:nextcloud:tables::::::nextcloud::*

History

No history.

Information

Published : 2026-06-01 19:16

Updated : 2026-07-22 08:10

NVD link : CVE-2026-45545

Mitre link : CVE-2026-45545

CVE.ORG link : CVE-2026-45545

JSON object : View

Products Affected

nextcloud

tables

CWE

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

{"id": "CVE-2026-45545", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-45545", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-02T15:23:14.033691Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.8, "exploitabilityScore": 1.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "nextcloud", "product": "security-advisories", "versions": [{"status": "affected", "version": ">= 0.7.0, < 0.7.7"}, {"status": "affected", "version": ">= 0.8.0, < 0.8.10"}, {"status": "affected", "version": ">= 0.9.0, < 0.9.8"}, {"status": "affected", "version": ">= 1.0.0, < 1.0.4"}]}]}], "published": "2026-06-01T19:16:52.020", "references": [{"url": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-x43f-gmgh-vvjj", "tags": ["Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/nextcloud/tables/pull/2309", "tags": ["Issue Tracking", "Patch"], "source": "security-advisories@github.com"}, {"url": "https://hackerone.com/reports/3462991", "tags": ["Permissions Required"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-89"}]}], "descriptions": [{"lang": "en", "value": "Nextcloud is an open source content collaboration platform. From versions 0.7.0 to before 0.7.7, 0.8.0 to before 0.8.10, 0.9.0 to before 0.9.8, and 1.0.0 to before 1.0.4, an authenticated attacker with access to the Tables app may be able to execute arbitrary up to 20 bytes long SQL queries, through a stored injection. With carefully crafted input it is possible to break out of the length limitation. The attacker could use this to extract information from the database, or modify data. This issue has been patched in versions 0.7.7, 0.8.10, 0.9.8, 1.0.4, and 2.0.0."}, {"lang": "es", "value": "Nextcloud es una plataforma de colaboraci\u00f3n de contenido de c\u00f3digo abierto. Desde las versiones 0.7.0 hasta antes de la 0.7.7, de la 0.8.0 hasta antes de la 0.8.10, de la 0.9.0 hasta antes de la 0.9.8, y de la 1.0.0 hasta antes de la 1.0.4, un atacante autenticado con acceso a la aplicaci\u00f3n Tables podr\u00eda ejecutar consultas SQL arbitrarias de hasta 20 bytes de longitud, a trav\u00e9s de una inyecci\u00f3n almacenada. Con una entrada cuidadosamente elaborada, es posible eludir la limitaci\u00f3n de longitud. El atacante podr\u00eda usar esto para extraer informaci\u00f3n de la base de datos o modificar datos. Este problema ha sido parcheado en las versiones 0.7.7, 0.8.10, 0.9.8, 1.0.4 y 2.0.0."}], "lastModified": "2026-07-22T08:10:00.117", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:nextcloud:tables:*:*:*:*:*:nextcloud:*:*", "vulnerable": true, "matchCriteriaId": "27CC977D-61ED-4C97-90DB-6CB5F4D27CA4", "versionEndExcluding": "0.7.7", "versionStartIncluding": "0.7.0"}, {"criteria": "cpe:2.3:a:nextcloud:tables:*:*:*:*:*:nextcloud:*:*", "vulnerable": true, "matchCriteriaId": "AEACC561-5610-4940-A246-5E2A51BD35C1", "versionEndExcluding": "0.8.10", "versionStartIncluding": "0.8.0"}, {"criteria": "cpe:2.3:a:nextcloud:tables:*:*:*:*:*:nextcloud:*:*", "vulnerable": true, "matchCriteriaId": "36CBF1A6-A92D-4F31-8DE3-245D5DF3B3DD", "versionEndExcluding": "0.9.8", "versionStartIncluding": "0.9.0"}, {"criteria": "cpe:2.3:a:nextcloud:tables:*:*:*:*:*:nextcloud:*:*", "vulnerable": true, "matchCriteriaId": "93525B1A-60DB-4A65-BC05-96E1D3A4DA65", "versionEndExcluding": "1.0.4", "versionStartIncluding": "1.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}