CVE-2026-45286 — Security Box Score

CVE · referencelatest edition

Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2026-45286MEDIUM

Nextcloud: Calendar app leaked user identifiers via attendee suggestion endpoint

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   L   N  U  L  N  N    4.3   .0028   20.6     —

AFFECTED
  Product              Versions               Fixed
  security-advisories  >= 5.5.13, < 5.5.17 –  —

TIMELINE
  May 11  Reserved by GitHub_M
  Jun 1   EXPLOIT PUBLISHED — CVE-2026-45286 (nextcloud security-advisories). Public exploit reference added.
  Jun 1   Published (CNA: GitHub_M)

CWE-200 · CNA: GitHub_M · CVSS v3.1 · 4 references · NVD status: Analyzed

Description

Nextcloud is an open source content collaboration platform. From versions 5.5.13 to before 5.5.17, and 6.2.0 to before 6.2.3, an authenticated user can enumerate users on the same Nextcloud instance by using the Calendar app's endpoint for suggesting attendees. The sharing restrictions, applied to other endpoints, were not effective here. This issue has been patched in versions 5.5.17 and 6.2.3.

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
May 11, 2026	Reserved	Reserved by GitHub_M
June 1, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2026-45286 (nextcloud security-advisories). Public exploit reference added.
June 1, 2026	Published	Published (CNA: GitHub_M)

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
nextcloud	security-advisories	—	>= 5.5.13, < 5.5.17	—

Weaknesses

CWE-200

References (4)

https://github.com/nextcloud/calendar/issues/7971 [Exploit, Issue Tracking, Patch]
https://github.com/nextcloud/calendar/pull/8197 [Issue Tracking, Patch]
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-r697-74m9-gvf2 [Mitigation, Vendor Advisory]
https://hackerone.com/reports/3540663 [Permissions Required]

Authoritative record: CVE-2026-45286 at cve.org

Vendors: nextcloud

Weaknesses: CWE-200

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-45286 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.