Nextcloud (Server, Tables, Whiteboard, Files Confidential, Collectives, Richdocuments): Mehrere Schwachstellen
WID-SEC-2026-4185 · first 27.10.2026 · updated 28.10.2026 · CVSS 7,5
What it is about
Nextcloud ist eine "on-premise" Plattform für Dateifreigabe und Zusammenarbeit. Ein Angreifer kann mehrere Schwachstellen in Nextcloud ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Daten zu manipulieren oder offenzulegen sowie Denial-of-Service-Zustände auszulösen.
Under what conditions?
The BSI does not name any particular preconditions. Exploitable remotely according to the BSI.
What can happen in the worst case
An attacker could use the vulnerability to
- Sicherheitsvorkehrungen zu umgehen
- Daten zu manipulieren oder offenzulegen sowie Denial-of-Service-Zustände auszulösen
Am I affected?
Affected according to the BSI:
- Nextcloud Nextcloud Files Confidential
- Nextcloud Nextcloud Collectives
- Nextcloud Nextcloud Richdocuments
- Nextcloud Nextcloud Server
- Nextcloud Nextcloud Tables
- Nextcloud Nextcloud Whiteboard
The installed version is usually shown under “Help → About” or in the device’s admin interface.
What helps?
Install the updates provided by the vendor; details in the sources below.
Is the vulnerability already being exploited?
None of the CVEs is in the CISA catalogue of exploited vulnerabilities. That does not mean there are no attacks, only that none are documented.
Information and sources
- Original BSI advisory (WID)
- GitHub Security Advisory GHSA-5572-968j-v7g5 vom 2026-10-26 github.com
- GitHub Security Advisory GHSA-67c5-gw7r-w35f vom 2026-10-26 github.com
- GitHub Security Advisory GHSA-6m4h-j3wr-v388 vom 2026-10-26 github.com
- GitHub Security Advisory GHSA-c47x-m7w6-c4q8 vom 2026-10-26 github.com
- GitHub Security Advisory GHSA-g8qc-xvwr-f684 vom 2026-10-26 github.com
- GitHub Security Advisory GHSA-gxg4-gmhx-4qj3 vom 2026-10-26 github.com
- GitHub Security Advisory GHSA-p9qq-6vpv-x7wj vom 2026-10-26 github.com
- GitHub Security Advisory GHSA-qwm4-h3xh-gmvc vom 2026-10-26 github.com
- GitHub Security Advisory GHSA-w7pp-8m7c-555c vom 2026-10-26 github.com
- GitHub Security Advisory GHSA-x4hv-m8g6-5cj4 vom 2026-10-26 github.com
CVE: CVE-2026-114601, CVE-2026-67400, CVE-2026-77167, CVE-2026-77171, CVE-2026-77172, CVE-2026-77173, CVE-2026-82983, CVE-2026-82984, CVE-2026-82986, CVE-2026-87897
Source: BSI warning and information service (CERT-Bund); CISA. The assessment of the conditions is my reading of the BSI text; the external pages are in their original language.