Nextcloud CVE-2026-45281 Cross-Account Calendar Takeover

CVE

CVE-2026-45281

Vendor

Nextcloud

Product

Nextcloud Server / Calendar

Affected versions

Nextcloud Server 32.x < 32.0.9 and 33.x < 33.0.3; affected Enterprise branches 21.x-33.x require their listed security patch

CVSS

8.1

Published

2026-07-17 00:00

Collected

2026-07-31 00:44

---
id: 5589
title: "Nextcloud CVE-2026-45281 Cross-Account Calendar Takeover"
cve: CVE-2026-45281
cvss: 8.1
severity: high
vendor: "Nextcloud"
product: "Nextcloud Server / Calendar"
affected_versions: "Nextcloud Server 32.x < 32.0.9 and 33.x < 33.0.3; affected Enterprise branches 21.x-33.x require their listed security patch"
source_domain: ethiack.com
source_url: "https://ethiack.com/info-hub/research/nextcloud-cve-2026-45281"
published_at: "2026-07-17T00:00:00Z"
tags: ["vulnerability-research", "access-control", "calendar-security", "nextcloud", "vulnerability", "ethiack", "cve-2026-45281", "caldav"]
phying_url: "https://phying.com/item/5589"
lang: en
---

# Nextcloud CVE-2026-45281 Cross-Account Calendar Takeover

## Summary

Ethiack shows CVE-2026-45281: an authorization gap in Nextcloud's CalDAV stack lets any authenticated user join another user's calendar-proxy-write group via PROPPATCH, taking over their calendars.

## Intelligence Metadata

- **Sources:** ethiack.com
- **CVE:** CVE-2026-45281
- **CVSS:** 8.1
- **Vendor:** Nextcloud
- **Product:** Nextcloud Server / Calendar
- **Affected versions:** Nextcloud Server 32.x < 32.0.9 and 33.x < 33.0.3; affected Enterprise branches 21.x-33.x require their listed security patch
- **Published:** 2026-07-17T00:00:00Z
- **Original:** https://ethiack.com/info-hub/research/nextcloud-cve-2026-45281
- **Phying News:** https://phying.com/item/5589