CVE-2026-45264: Nextcloud Permission Bypass Allows Unauthorized File Renaming in Team Folders

Technical summary

The vulnerability stems from insufficient permission validation during file rename operations in team folder contexts. Nextcloud's permission model distinguishes between READ, CREATE, and UPDATE permissions; however, the rename functionality does not properly enforce the UPDATE permission requirement. A user granted READ and CREATE permissions can invoke rename operations without triggering the expected authorization check for UPDATE permissions. This is classified as an Improper Access Control issue (CWE-284). The network-based, low-complexity attack vector and low privilege requirement make this readily exploitable by any authenticated user with the specified permission set.

Business impact

While the CVSS score of 4.3 reflects moderate severity, the practical impact depends on deployment context. In environments where READ/CREATE permissions are broadly delegated (e.g., project teams uploading documents), unauthorized renaming could obscure file provenance, break downstream automation reliant on consistent naming conventions, or facilitate subtle data manipulation attacks. Compliance frameworks requiring audit trails and immutable naming schemes may be violated. For organizations using Nextcloud as a primary collaboration hub, widespread exploitation could degrade operational efficiency and create forensic gaps.

Affected systems

Nextcloud versions 17.0.0–17.0.14, 18.0.0–18.1.11, 19.0.0–19.1.15, 20.0.0–20.1.10, and 21.0.0–21.0.3 are vulnerable. Patched versions are 17.0.15, 18.1.12, 19.1.16, 20.1.11, and 21.0.4 respectively. Organizations running Nextcloud in any of these version ranges with team folders and delegated READ/CREATE permissions are at risk. The vulnerability does not require special configuration; it affects default permission enforcement.

Exploitability

Exploitability is straightforward for any authenticated user within the affected permission scope. No special tooling, unusual network conditions, or user interaction is required—the attacker simply invokes the rename API or UI action against a team folder file they have READ and CREATE access to. The low CVSS Access Complexity (AC:L) and Privileges Required (PR:L) rating reflects this ease of exploitation. However, widespread attack depends on the attacker already possessing appropriate permissions and identifying team folders with the vulnerable permission configuration.

Remediation

Upgrade to patched versions: 17.0.15 or later (17.x), 18.1.12 or later (18.x), 19.1.16 or later (19.x), 20.1.11 or later (20.x), or 21.0.4 or later (21.x). Patches restore proper permission enforcement, requiring UPDATE permission for all file rename operations. For environments unable to patch immediately, audit team folder permission assignments and consider temporarily restricting CREATE permissions for users who should not be able to rename files, though this may limit legitimate collaboration workflows.

Patch guidance

Nextcloud provides official patches for all affected version lines. Review your current Nextcloud version using the admin settings or command-line interface. Consult the official Nextcloud security advisory and your vendor's patch release notes to confirm the exact patched version available for your release line before upgrading. Test patches in a staging environment to verify compatibility with custom apps or integrations. Given the moderate severity and low complexity of exploitation, prioritize patching within 2–3 weeks. Follow Nextcloud's documented upgrade procedure, including database migration steps if applicable.

Detection guidance

Monitor Nextcloud logs for unusual file rename operations within team folders, particularly by users whose permission profiles should not permit renames. Review access logs for patterns of repeated rename attempts by low-privilege accounts. If your monitoring stack supports it, alert on any rename operation by a user account lacking explicit UPDATE permission on the affected resource. Post-patch, verify that rename operations now consistently require UPDATE permission by testing with constrained user accounts in a controlled setting.

Why prioritize this

Although not designated as Known Exploited Vulnerability (KEV) status and rated MEDIUM severity, this vulnerability merits prompt attention because: (1) exploitation requires no sophistication or special conditions beyond normal authentication; (2) it directly undermines the permission model users rely on for team collaboration and access control; (3) it affects five active version lines spanning nearly two years of releases; and (4) successful exploitation leaves subtle, potentially deniable audit trails that may complicate forensic response. Organizations with strict compliance requirements or audit trail dependencies should prioritize this above other MEDIUM-severity items.

Risk score, explained

The CVSS 3.1 score of 4.3 (MEDIUM) reflects network accessibility, low attack complexity, and low privilege requirements, offset by limited integrity impact (no confidentiality or availability loss). The score appropriately captures technical exploitability but may underweight organizational risk in highly collaborative environments where file naming conventions and auditability are critical. Security teams should consider local factors—deployment sensitivity, user base size, and audit requirements—when mapping this score to internal risk ratings.

Frequently asked questions