CVE-2026-45281: Nextcloud: Cross-Account Calendar Takeover via Unauthorized Group-Member-Set Update

Synopsis

An improper authorization vulnerability in Nextcloud Server allows an authenticated attacker to take over another user's calendar by sending a crafted request to a known principal URL. The attack is reachable over the network, requires a low-privilege account, and needs no victim interaction. Successful exploitation gives the attacker full read and write access to the targeted user's calendar. No fix version has been published yet; HarborGuard tracks this advisory and will make a patched-image rebuild available as soon as upstream ships a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network; an attacker must be able to reach the Nextcloud Server instance via HTTP/HTTPS to send the crafted principal URL request.

• AuthenticationRequired

  The attacker must hold a valid low-privilege Nextcloud account; any ordinary user credential is sufficient to trigger the improper authorization flaw.

• Victim interactionNot required

  No action is needed from the calendar owner; the attacker sends the request directly to the backend without any social-engineering step.

• Attack complexityDetail

  The exploit is reliable and condition-free once the attacker knows the target user's principal URL; no race conditions or special environmental factors are required.

Blast Radius

• Reads all calendar events stored in the targeted user's calendar, including meeting titles, attendees, locations, and private notes.
• Modifies or deletes calendar entries in the targeted user's calendar, enabling appointment tampering or disruption of scheduled workflows.
• Exposes organizational scheduling patterns and participant details that can be leveraged for further social-engineering attacks.