CVE-2026-82986

Group-level link‑sharing bypass in Nextcloud Tables

The user in a group can bypass the group restriction set by an administrator on link sharing, creating share links for a table even though they shouldn't have that permission.

CVSS 3.0 · 4.6 Medium EPSS < 1% KEV · Not listed

Vendors

Nextcloud

Products

Tables

CVE-2026-82983

tables: Nextcloud Tables: Information disclosure via missing permission check on share-listing endpoint

The Tables app's share-listing endpoint (GET /apps/tables/share/table/{tableId}) did not verify that the requesting user has manage-level permission on the table before returning the full list of share recipients (users, groups, and teams) along with their permission levels. A user who was only granted read-data access to a table, and who is correctly prevented from seeing this information in the web UI, could call the endpoint directly to enumerate everyone the table is shared with and their access levels. This does not expose the table's data itself beyond what the read-data grant already permits, only the list of share recipients and their permission levels.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Nextcloud

Products

Tables

CVE-2026-45722

Nextcloud: Tables app allows limited SQLi in ORDER BY with malicious sort order argument for Table Views

Nextcloud is an open source content collaboration platform. From versions 0.9.0 to before 0.9.7, and 1.0.0 to before 1.0.2, a missing sanitization in the Tables app allowed a user with access to the tables app to perform a limited SQL injection in the ORDER BY statement of a query. Compared to normal SQL injections, the ORDER BY is limited to extracting a single bit of information per request or to make the database wait for a given time. This issue has been patched in versions 0.9.7 and 1.0.2.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Nextcloud

Products

Tables

CVE-2026-45545

Nextcloud: SQL Injection in Column Type Parameter Allows Arbitrary SQL Execution

Nextcloud is an open source content collaboration platform. From versions 0.7.0 to before 0.7.7, 0.8.0 to before 0.8.10, 0.9.0 to before 0.9.8, and 1.0.0 to before 1.0.4, an authenticated attacker with access to the Tables app may be able to execute arbitrary up to 20 bytes long SQL queries, through a stored injection. With carefully crafted input it is possible to break out of the length limitation. The attacker could use this to extract information from the database, or modify data. This issue has been patched in versions 0.7.7, 0.8.10, 0.9.8, 1.0.4, and 2.0.0.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Nextcloud

Products

Tables

CVE-2026-45544

Nextcloud: Information Disclosure of view filter metdata via Broken Sensitive Data Masking in ViewService

Nextcloud is an open source content collaboration platform. From version 0.8.0 to before version 1.0.4, the view filter criteria is exposed to users with read-only permissions in Nextcloud Tables. This issue has been patched in versions 1.0.4 and 2.0.0.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Nextcloud

Products

Tables

CVE-2025-58051

Nextcloud Tables app allowed to include local file via PhpSpreadsheet when importing a table

Nextcloud Tables allows you to create your own tables with individual columns. Prior 0.7.6, 0.8.8, and 0.9.5, when importing a table, a user was able to specify files on the server and when their format is supported by the used PhpSpreadsheet library they would be included and their content leaked to the user. It is recommended that the Nextcloud Tables app is upgraded to 0.7.6, 0.8.8 or 0.9.5.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Nextcloud

Products

Tables

CVE-2025-66551

Nextcloud Tables is missing an ownership check which allows moving columns into tables of other users

Nextcloud Tables allows you to create your own tables with individual columns. Prior to 0.8.6 and 0.9.3, a malicious user was able to create their own table and then move a column to a victims table. This vulnerability is fixed in 0.8.6 and 0.9.3.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Nextcloud

Products

Tables

CVE-2025-66513

Nextcloud Tables app share information not limited to relevant users

Nextcloud Tables allows you to create your own tables with individual columns. Prior to 0.8.9, 0.9.6, and 1.0.1, the information which table (numeric ID) is shared with which groups or users and the respective permissions was not limited to privileged users. This vulnerability is fixed in 0.8.9, 0.9.6, and 1.0.1.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Nextcloud

Products

Tables

CVE-2025-66553

Nextcloud Tables app allowed users to view columns metadata information of any table

Nextcloud Tables allows you to create your own tables with individual columns. Prior to 0.8.7 and 0.9.4, authenticated users were able to view meta data of columns in other tables of the Tables app by modifying the numeric ID in a request. This vulnerability is fixed in 0.8.7 and 0.9.4.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Nextcloud

Products

Tables

CVE-2024-52507

Share information of the Nextcloud Tables app is not limited to affected users

Nextcloud Tables allows users to to create tables with individual columns. The information which Table (numeric ID) is shared with which groups and users and the respective permissions was not limited to affected users. It is recommended that the Nextcloud Tables app is upgraded to 0.8.1.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed

Vendors

Nextcloud

Products

Tables

CVE-2024-52511

Nextcloud Tables has an Authorization Bypass Through User-Controlled Key in Tables

Nextcloud Tables allows users to to create tables with individual columns. By directly specifying the ID of a table or view, a malicious user could blindly insert new rows into tables they have no access to. It is recommended that the Nextcloud Tables is upgraded to 0.8.0.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Nextcloud

Products

Tables