CVE Feed

    Dashboard / CVE / CVE-2026-68493

    CVE-2026-68493

    After guessing a 62^15 complex unique identifier, a malicious logged in user was able to retrieve a list of memberships for a circle they are not a member of.

    Published:Sep 18, 2026
    Last Modified:Sep 19, 2026
    EPS:Sep 18, 2026
    EPSS Score:0.0014
    CVSS Score:3.1

    Affected Products

    Vendor
    Nextcloud
    Product
    Server

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2026-82984 (CVSS 4.3) — When a team was configured as "visible to everyone", the web UI correctly blocked non-members from viewing the…
    CVE-2026-77172 (CVSS 5.3) — App passwords were allowed to bypass password confirmation on sensitive endpoints.…
    CVE-2026-77167 (CVSS 7.5) — Abusing the federated share endpoint, an attacker can write arbitrary rows into the oc_share_external database…
    CVE-2026-77165 (CVSS 6.5) — File owners were unable to unlock TYPE_TOKEN locks placed by other users, leaving files permanently locked wit…
    CVE-2026-77164 (CVSS 6.2) — Circles' remote-instance signature verification fetches the attacker-supplied keyId URL before trust in the re…
    CVE-2026-82985 (CVSS 6.5) — The Photos app's filter-based "smart albums" build their file listing using the search configuration (photosSo…
    CVE-2025-64011 (CVSS 4.3) — Nextcloud Server 30.0.0 is vulnerable to an Insecure Direct Object Reference (IDOR) in the /core/preview endpo…
    CVE-2025-66552 (CVSS 4.3) — Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server and Enterprise Server prior to 30…
    CVE-2025-66547 (CVSS 4.3) — Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server and Enterprise Server prior to 31…
    CVE-2025-66512 (CVSS 5.4) — Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server and Server Enterprise prior to 31…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High