Vulnerability in Nextcloud Server

[ Why it matters ]Priority signals

• Public proof-of-concept exploit exists (CISA SSVC)

[ Description ]Official description

File owners were unable to unlock TYPE_TOKEN locks placed by other users, leaving files permanently locked with no recovery path outside of the database.

[ Fixes ]Fixes and patches

• Security bulletin: Nextcloud GHSA-f99w-3pm7-v4cvVendor patch or bulletin · CERT-FR · github.com/nextcloud/security-advisories/security/advisories/GHSA-f99w, cited by CERT-FR CERTFR-2026-AVI-1283
• Security bulletin: Nextcloud GHSA-4vpp-fp9q-9g23Vendor patch or bulletin · CERT-FR · github.com/nextcloud/security-advisories/security/advisories/GHSA-4vpp, cited by CERT-FR CERTFR-2026-AVI-1283
• Security bulletin: Nextcloud GHSA-5gv7-hw69-w6pxVendor patch or bulletin · CERT-FR · github.com/nextcloud/security-advisories/security/advisories/GHSA-5gv7, cited by CERT-FR CERTFR-2026-AVI-1283
• Security bulletin: Nextcloud GHSA-9mjh-89xm-hcqwVendor patch or bulletin · CERT-FR · github.com/nextcloud/security-advisories/security/advisories/GHSA-9mjh, cited by CERT-FR CERTFR-2026-AVI-1283
• Security bulletin: Nextcloud GHSA-22w9-gpgv-pcgcVendor patch or bulletin · CERT-FR · github.com/nextcloud/security-advisories/security/advisories/GHSA-22w9, cited by CERT-FR CERTFR-2026-AVI-1283

[ Advisories ]Government CERT advisories

• CERT-FR9 Oct 2026CERTFR-2026-AVI-1283

  Multiple vulnerabilities in Nextcloud products Translated from French

  Multiple vulnerabilities have been discovered in Nextcloud products. Some of them allow an attacker to cause privilege escalation, remote denial of service and a breach of data confidentiality.

  CVE-2026-82985CVE-2026-68493CVE-2026-77169+2 more CVEs
• BSI CERT-Bund8 Oct 2026WID-SEC-2026-3840

  Nextcloud: Multiple vulnerabilities Translated from German

  CVE-2026-77166CVE-2026-77169CVE-2026-68493+2 more CVEs

[ References ]References

• hackerone.com/reports/3770482