Skip to content
Threat Feed
Subscribe
medium advisory

Nextcloud: Multiple vulnerabilities in Server and plugins

Nextcloud disclosed multiple vulnerabilities across its server platform and various applications, including Tables, Whiteboard, Files Confidential, Collectives, and Richdocuments, which could allow attackers to bypass security controls, manipulate data, or cause Denial-of-Service.

CVE search metadata

CVE search record: CVE-2026-114601. KEV: no. Product: Nextcloud Server, Nextcloud Tables, Nextcloud Whiteboard, Nextcloud Files Confidential, Nextcloud Collectives, Nextcloud Richdocuments, Nextcloud Server Enterprise, Collectives (> 4.0.0, < 4.4.0), Files Confidential (3.3.x < 3.3.1, > 4.0.0 < 4.1.1, > 5.0.0 < 5.1.0), Richdocuments (11.0.x < 11.0.1, > 10.0.0 < 10.2.1, > 9.0.0 < 9.1.1). Brief: Nextcloud: Multiple vulnerabilities in Server and plugins. Brief link: https://feed.craftedsignal.io/briefs/2026-10-nextcloud-multi-vuln/

CVE search record: CVE-2026-67400. KEV: no. Product: Nextcloud Server, Nextcloud Tables, Nextcloud Whiteboard, Nextcloud Files Confidential, Nextcloud Collectives, Nextcloud Richdocuments, Nextcloud Server Enterprise, Collectives (> 4.0.0, < 4.4.0), Files Confidential (3.3.x < 3.3.1, > 4.0.0 < 4.1.1, > 5.0.0 < 5.1.0), Richdocuments (11.0.x < 11.0.1, > 10.0.0 < 10.2.1, > 9.0.0 < 9.1.1). Brief: Nextcloud: Multiple vulnerabilities in Server and plugins. Brief link: https://feed.craftedsignal.io/briefs/2026-10-nextcloud-multi-vuln/

CVE search record: CVE-2026-77167. Severity: high. CVSS: 7.5. KEV: no. Product: Nextcloud Server, Nextcloud Tables, Nextcloud Whiteboard, Nextcloud Files Confidential, Nextcloud Collectives, Nextcloud Richdocuments, Nextcloud Server Enterprise, Collectives (> 4.0.0, < 4.4.0), Files Confidential (3.3.x < 3.3.1, > 4.0.0 < 4.1.1, > 5.0.0 < 5.1.0), Richdocuments (11.0.x < 11.0.1, > 10.0.0 < 10.2.1, > 9.0.0 < 9.1.1). Brief: Nextcloud: Multiple vulnerabilities in Server and plugins. Brief link: https://feed.craftedsignal.io/briefs/2026-10-nextcloud-multi-vuln/

CVE search record: CVE-2026-77171. Severity: low. CVSS: 3.5. KEV: no. Product: Nextcloud Server, Nextcloud Tables, Nextcloud Whiteboard, Nextcloud Files Confidential, Nextcloud Collectives, Nextcloud Richdocuments, Nextcloud Server Enterprise, Collectives (> 4.0.0, < 4.4.0), Files Confidential (3.3.x < 3.3.1, > 4.0.0 < 4.1.1, > 5.0.0 < 5.1.0), Richdocuments (11.0.x < 11.0.1, > 10.0.0 < 10.2.1, > 9.0.0 < 9.1.1). Brief: Nextcloud: Multiple vulnerabilities in Server and plugins. Brief link: https://feed.craftedsignal.io/briefs/2026-10-nextcloud-multi-vuln/

CVE search record: CVE-2026-77172. Severity: medium. CVSS: 5.3. KEV: no. Product: Nextcloud Server, Nextcloud Tables, Nextcloud Whiteboard, Nextcloud Files Confidential, Nextcloud Collectives, Nextcloud Richdocuments, Nextcloud Server Enterprise, Collectives (> 4.0.0, < 4.4.0), Files Confidential (3.3.x < 3.3.1, > 4.0.0 < 4.1.1, > 5.0.0 < 5.1.0), Richdocuments (11.0.x < 11.0.1, > 10.0.0 < 10.2.1, > 9.0.0 < 9.1.1). Brief: Nextcloud: Multiple vulnerabilities in Server and plugins. Brief link: https://feed.craftedsignal.io/briefs/2026-10-nextcloud-multi-vuln/

CVE search record: CVE-2026-77173. Severity: medium. CVSS: 4.3. KEV: no. Product: Nextcloud Server, Nextcloud Tables, Nextcloud Whiteboard, Nextcloud Files Confidential, Nextcloud Collectives, Nextcloud Richdocuments, Nextcloud Server Enterprise, Collectives (> 4.0.0, < 4.4.0), Files Confidential (3.3.x < 3.3.1, > 4.0.0 < 4.1.1, > 5.0.0 < 5.1.0), Richdocuments (11.0.x < 11.0.1, > 10.0.0 < 10.2.1, > 9.0.0 < 9.1.1). Brief: Nextcloud: Multiple vulnerabilities in Server and plugins. Brief link: https://feed.craftedsignal.io/briefs/2026-10-nextcloud-multi-vuln/

Triage facts

Revision 2
Applicability
Nextcloud Server, Nextcloud Tables +8
Evidence
Unknown
Severity
Medium
Action
Elevated
Sources
14 public sources
Freshness
Revision 2Oct 27, 17:40 UTC
Vulnerabilities
6 CVEs
Source quality
A1Likely
Revision history 1 entry · Revision 2
  1. Revision 2

    added coverage for Nextcloud Server +4 products

    Changed: action_plan, affected_products, cves, lastmod, priority, priority_score, priority_signals, references, updates

    Sources: 1

Nextcloud has issued a security advisory regarding multiple vulnerabilities affecting the Nextcloud Server core and several official applications: Tables, Whiteboard, Files Confidential, Collectives, and Richdocuments. Successful exploitation of these issues may allow an attacker to bypass security measures, access or modify sensitive data, or impact service availability via Denial-of-Service (DoS). Specific CVE identifiers were not provided in the source material. Users are advised to review the official Nextcloud advisory portal for specific version remediation details.

Impact

Impact includes unauthorized data disclosure, data manipulation, security control bypass, and service disruption (DoS).

Recommendation

  • Inventory all Nextcloud instances and integrated applications, specifically Tables, Whiteboard, Files Confidential, Collectives, and Richdocuments.
  • Review the official Nextcloud security advisory portal to identify and apply the necessary patches for your specific versions.
  • Prioritize patching of internet-facing Nextcloud instances.

Immediate actions

Perform inventory of all deployed Nextcloud applications and versions

IT Operations 24h

Patch affected Nextcloud Server and application versions to the latest releases listed in the vendor advisories.

IT Operations 48h

Threat Hunt

Monitor web server access logs for anomalous request patterns targeting /apps/ or known plugin endpoints

T1190 medium medium confidence hunt now

Data: Web server access logs (cs-uri-stem, sc-status, cs-method)

Mitigations

Update Nextcloud Server and affected apps to the latest security release

immediate IT Operations

Vulnerabilities in Nextcloud core and extensions