What’s Vulnerable › Vulnerabilities

CVE-2024-52516: Nextcloud Server's shares are not removed when user is limited to share with in their groups and being removed from one of them

• Severity: medium (CVSS 4.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-11-15 · updated 2026-06-17
• Weakness: CWE-269

Description

Nextcloud Server is a self hosted personal cloud system. When a server is configured to only allow sharing with users that are in ones own groups, after a user was removed from a group, previously shared items were not unshared. It is recommended that the Nextcloud Server is upgraded to 22.2.11 or 23.0.11 or 24.0.6 and Nextcloud Enterprise Server is upgraded to 22.2.11 or 23.0.11 or 24.0.6.

Affected products

• Nextcloud Server: from 26.0.0 before 26.0.13.9; from 27.0.0 before 27.1.11.9; from 28.0.0 before 28.0.9; from 29.0.0 before 29.0.5 — fixed in 26.0.13.9, 27.1.11.9, 28.0.9, 29.0.5

How to fix

Upgrade to a fixed version: Nextcloud Server 26.0.13.9, 27.1.11.9, 28.0.9, 29.0.5. Check the vendor advisory for mitigations.

References

• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-35gc-jc6x-29cm
• https://github.com/nextcloud/server/commit/142b6e313ffa9d3b950bcd23cb58850d3ae7cf34
• https://github.com/nextcloud/server/pull/47180

Get alerted when CVE-2024-52516 or the next vulnerability affects your stack