CVE-2026-45722: Nextcloud: Tables app allows limited SQLi in ORDER BY with malicious sort order argument for Table Views

Synopsis

A partial SQL injection vulnerability affects the Nextcloud Tables app in versions 0.9.0 through 0.9.6 and 1.0.0 through 1.0.1. An authenticated attacker who can access the Tables app reaches the flaw over the network by supplying a malicious sort-order argument to a Table View query, injecting content into the ORDER BY clause of the underlying SQL statement. Successful exploitation lets an attacker extract database contents one bit at a time or stall the database with time-delay queries, leaking confidential data and degrading service availability. Fix versions 0.9.7 and 1.0.2 have been identified upstream; however, no patched image rebuild is currently available on HarborGuard as the upstream fix versions have not yet been formally published to advisory feeds, and HarborGuard is tracking the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Nextcloud Tables app over the network; the vulnerable endpoint is exposed via the standard Nextcloud HTTP interface.

• AuthenticationRequired

  Any low-privilege account with access to the Tables app is sufficient; no administrative rights are needed.

• Victim interactionNot required

  The attacker can exploit the flaw directly by crafting a malicious sort-order request; no action from another user is needed.

• Attack complexityDetail

  Exploit conditions are straightforward and reliable; no race conditions or special environmental prerequisites are required to inject into the ORDER BY clause.

Blast Radius

• Reads database contents one bit per request using blind SQL injection techniques, enabling slow but systematic extraction of stored data such as table contents, user records, or configuration values.
• Causes the database to pause execution for attacker-controlled durations via time-delay injection, degrading availability of the Nextcloud instance for legitimate users.
• Confidentiality impact is high; an attacker with enough requests can reconstruct sensitive stored information from the database.
• Availability impact is partial; deliberate time-delay queries can slow or disrupt database responsiveness without fully crashing the service.