[ CVE-2026-67400 · Published 27 Oct 2026 ]
Vulnerability in Nextcloud Richdocuments
CVSS 3.5
EPSS <1%2 agency advisoriesFix available
[ Description ]Official description
A missing token type check allowed to retrieve more additional information about the WOPI configuration with a user or guest token.
[ Fixes ]Fixes and patches
- Security bulletin: Nextcloud GHSA-p9qq-6vpv-x7wjVendor patch or bulletin · CERT-FR · github.com/nextcloud/security-advisories/security/advisories/GHSA-p9qq, cited by CERT-FR CERTFR-2026-AVI-1392
- Security bulletin: Nextcloud GHSA-w7pp-8m7c-555cVendor patch or bulletin · CERT-FR · github.com/nextcloud/security-advisories/security/advisories/GHSA-w7pp, cited by CERT-FR CERTFR-2026-AVI-1392
- Security bulletin: Nextcloud GHSA-5572-968j-v7g5Vendor patch or bulletin · CERT-FR · github.com/nextcloud/security-advisories/security/advisories/GHSA-5572, cited by CERT-FR CERTFR-2026-AVI-1392
- Security bulletin: Nextcloud GHSA-qwm4-h3xh-gmvcVendor patch or bulletin · CERT-FR · github.com/nextcloud/security-advisories/security/advisories/GHSA-qwm4, cited by CERT-FR CERTFR-2026-AVI-1392
- Security bulletin: Nextcloud GHSA-x4hv-m8g6-5cj4Vendor patch or bulletin · CERT-FR · github.com/nextcloud/security-advisories/security/advisories/GHSA-x4hv, cited by CERT-FR CERTFR-2026-AVI-1392
- Security bulletin: Nextcloud GHSA-6m4h-j3wr-v388Vendor patch or bulletin · CERT-FR · github.com/nextcloud/security-advisories/security/advisories/GHSA-6m4h, cited by CERT-FR CERTFR-2026-AVI-1392
[ Advisories ]Government CERT advisories
-
CERT-FRCERTFR-2026-AVI-1392
Multiple vulnerabilities in Nextcloud products Translated from French
Multiple vulnerabilities have been discovered in Nextcloud products. Some of them allow an attacker to cause remote denial of service, a breach of data confidentiality and a security policy bypass.
- BSI CERT-BundWID-SEC-2026-4185