CVE-2026-45155: Nextcloud Server Circles Authorization Bypass – Membership Tracking Risk

Technical summary

CVE-2026-45155 is an authorization bypass affecting Nextcloud Server versions 32.0.0–32.0.6 and 33.0.0–33.0.0. The API endpoint responsible for circle membership management fails to validate whether the requesting user has permission to add unknown circles by ID to target circles. The vulnerability stems from CWE-639 (Authorization Bypass Through User-Controlled Key), where the API accepts circle IDs as direct input without confirming the requester's access rights. Although circle IDs employ 62^15 algorithmic complexity, the weakness allows membership enumeration and potential social engineering if IDs are leaked or discovered through side channels.

Business impact

Organizations using Nextcloud as a collaboration platform face a risk of unauthorized circle membership tracking. An authenticated attacker with knowledge of valid circle IDs could monitor or infer collaboration patterns, potentially exposing organizational structure or sensitive project affiliations. While the barrier to exploitation is high due to the need for valid circle IDs and user interaction, the confidentiality impact—tracking who collaborates on what—could matter in competitive or regulated environments where project teams must remain confidential.

Affected systems

Nextcloud Server versions 32.0.0 through 32.0.6 and 33.0.0 through 33.0.0 are vulnerable. Nextcloud Enterprise Server users running versions 29.0.x through 32.x are affected until patched to the specified maintenance builds. Nextcloud Server instances deployed in either community or enterprise editions with the circles app enabled and exposed to authenticated users are at risk. Self-hosted and SaaS-deployed instances are both in scope.

Exploitability

Exploitation requires an authenticated Nextcloud user account and knowledge of a target circle's ID. The attack vector is network-based and does not require elevated privileges within Nextcloud, though it does require valid credentials. The high complexity of circle IDs (62^15) makes random guessing impractical; attackers must obtain IDs through legitimate access to the platform, external leaks, or error messages. User interaction is noted in the CVSS vector, likely reflecting the need for social engineering or an action that exposes circle IDs. Public exploit code is not known, and the vulnerability is not currently tracked in the CISA Known Exploited Vulnerabilities catalog.

Remediation

Upgrade Nextcloud Server to version 32.0.7 or 33.0.1 immediately. For Nextcloud Enterprise Server, apply the appropriate maintenance release: 29.0.16.14, 30.0.17.8, 31.0.14.3, 32.0.7, or 33.0.1, depending on your version line. These patches restore authorization checks to the circle API endpoints. Review access logs for any suspicious circle additions during the vulnerability window. Consider temporarily disabling the circles app in sensitive deployments if immediate patching is not feasible.

Patch guidance

Nextcloud releases patches through its security update channels. Community administrators should enable automatic updates or manually download patched builds from the Nextcloud download portal. Enterprise customers should consult their support contract for staged rollout guidance. Test patches in a non-production environment first to confirm compatibility with custom circles configurations or integrations. After patching, audit circle memberships for any unauthorized additions and revoke suspicious entries.

Detection guidance

Monitor API logs for unusual calls to circle membership endpoints (typically `/ocs/v2.php/apps/circles/*` patterns) originating from non-administrative accounts. Flag cases where circle IDs are added by users who have no documented collaboration relationship with those circles. Implement alerts on circle membership changes, especially for sensitive or high-value circles. Review authentication logs for sessions that accessed the circles API but did not correspond to known user workflows. Security Information and Event Management (SIEM) rules can correlate failed and successful circle-related API calls to identify reconnaissance attempts.

Why prioritize this

Despite the LOW CVSS score (2.6), this vulnerability merits patching in standard maintenance cycles rather than emergency response. The confidentiality risk—unauthorized visibility into collaboration patterns—is non-trivial in regulated or competitive industries. However, the requirement for valid circle IDs and authenticated access significantly reduces risk in most deployments. Organizations should prioritize patching if they consider project team information sensitive or if they suspect external parties may have circle ID information. Standard patch windows are appropriate for most enterprises.

Risk score, explained

The CVSS 3.1 score of 2.6 (LOW) reflects the attack vector (network-accessible but requiring authentication), high attack complexity (needing a valid circle ID), and limited impact scope (confidentiality only, no integrity or availability impact). The user interaction requirement further constrains the rating. However, the score does not capture context-specific risks: organizations where team affiliation is a trade secret or where circles contain sensitive information may warrant higher internal risk ratings independent of the base CVSS.

Frequently asked questions