CVE-2026-68493
No fix known EPSS <1%CVSS 3.1
After guessing a 62^15 complex unique identifier, a malicious logged in user was able to retrieve a list of memberships for a circle they are not a member of.
Products: nextcloud server
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | nextcloud-server-32 | no fix |
| Chainguard | nextcloud-server-33 | no fix |
| Wolfi | nextcloud-server-33 | no fix |