CVE Feed

    Dashboard / CVE / CVE-2026-77165

    CVE-2026-77165

    File owners were unable to unlock TYPE_TOKEN locks placed by other users, leaving files permanently locked with no recovery path outside of the database.

    Published:Sep 21, 2026
    Last Modified:Sep 21, 2026
    EPS:Sep 21, 2026
    EPSS Score:
    CVSS Score:6.5

    Affected Products

    Vendor
    Nextcloud
    Product
    Server

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-284 Improper Access Control

    Related CVEs

    CVE-2026-82984 (CVSS 4.3) — When a team was configured as "visible to everyone", the web UI correctly blocked non-members from viewing the…
    CVE-2026-77172 (CVSS 5.3) — App passwords were allowed to bypass password confirmation on sensitive endpoints.…
    CVE-2026-77167 (CVSS 7.5) — Abusing the federated share endpoint, an attacker can write arbitrary rows into the oc_share_external database…
    CVE-2026-68493 (CVSS 3.1) — After guessing a 62^15 complex unique identifier, a malicious logged in user was able to retrieve a list of me…
    CVE-2026-77164 (CVSS 6.2) — Circles' remote-instance signature verification fetches the attacker-supplied keyId URL before trust in the re…
    CVE-2026-82985 (CVSS 6.5) — The Photos app's filter-based "smart albums" build their file listing using the search configuration (photosSo…
    CVE-2025-64011 (CVSS 4.3) — Nextcloud Server 30.0.0 is vulnerable to an Insecure Direct Object Reference (IDOR) in the /core/preview endpo…
    CVE-2025-66552 (CVSS 4.3) — Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server and Enterprise Server prior to 30…
    CVE-2025-66547 (CVSS 4.3) — Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server and Enterprise Server prior to 31…
    CVE-2025-66512 (CVSS 5.4) — Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server and Server Enterprise prior to 31…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High