Nextcloud: Mehrere Schwachstellen
WID-SEC-2026-3840 · first 09.10.2026 · updated 09.10.2026 · CVSS 6,5
What it is about
Nextcloud ist eine "on-premise" Plattform für Dateifreigabe und Zusammenarbeit. Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen im Nextcloud Server und verschiedenen Apps ausnutzen, um Informationen offenzulegen, um Sicherheitsmechanismen zu umgehen und um einen Denial of Service herbeizuführen.
Under what conditions?
Over the network, but only with valid access (login required), for example with stolen credentials or as an insider.
What can happen in the worst case
An attacker could use the vulnerability to
- Informationen offenzulegen
- Sicherheitsmechanismen zu umgehen
- einen Denial of Service herbeizuführen
Am I affected?
Affected according to the BSI:
- Nextcloud Nextcloud Server <32.0.12
- Nextcloud Nextcloud Server <33.0.6
- Nextcloud Nextcloud Server <34.0.1
- Nextcloud Nextcloud Server <32.0.6
- Nextcloud Nextcloud Collectives <4.4.1
- Nextcloud Nextcloud Team Folders <13.1.8
- Nextcloud Nextcloud Team Folders <14.0.12
- Nextcloud Nextcloud Team Folders <15.3.13
- Nextcloud Nextcloud Team Folders <16.0.16
- Nextcloud Nextcloud Team Folders <17.0.16
- Nextcloud Nextcloud Team Folders <18.1.14
- Nextcloud Nextcloud Team Folders <19.1.19
and 3 more
The installed version is usually shown under “Help → About” or in the device’s admin interface.
What helps?
Update to at least:
- Nextcloud Nextcloud Server 32.0.12
- Nextcloud Nextcloud Server 33.0.6
- Nextcloud Nextcloud Server 34.0.1
- Nextcloud Nextcloud Server 32.0.6
- Nextcloud Nextcloud Collectives 4.4.1
- Nextcloud Nextcloud Team Folders 13.1.8
- Nextcloud Nextcloud Team Folders 14.0.12
- Nextcloud Nextcloud Team Folders 15.3.13
- Nextcloud Nextcloud Team Folders 16.0.16
- Nextcloud Nextcloud Team Folders 17.0.16
- Nextcloud Nextcloud Team Folders 18.1.14
- Nextcloud Nextcloud Team Folders 19.1.19
Is the vulnerability already being exploited?
None of the CVEs is in the CISA catalogue of exploited vulnerabilities. That does not mean there are no attacks, only that none are documented.
Information and sources
- Original BSI advisory (WID)
- GitHub Security Advisory GHSA-22w9-gpgv-pcgc vom 2026-10-08 github.com
- GitHub Security Advisory GHSA-4vpp-fp9q-9g23 vom 2026-10-08 github.com
- GitHub Security Advisory GHSA-5gv7-hw69-w6px vom 2026-10-08 github.com
- GitHub Security Advisory GHSA-9mjh-89xm-hcqw vom 2026-10-08 github.com
- GitHub Security Advisory GHSA-f99w-3pm7-v4cv vom 2026-10-08 github.com
CVE: CVE-2026-68493, CVE-2026-77165, CVE-2026-77166, CVE-2026-77169, CVE-2026-82985
Source: BSI warning and information service (CERT-Bund); CISA. The assessment of the conditions is my reading of the BSI text; the external pages are in their original language.