Title: Nextcloud, Description: Nextcloud es una plataforma de colaboración de contenido de código abierto. En Nextcloud Server desde las versiones 32.0.0 hasta antes de la 32.0.9, y 33.0.0 hasta antes de la 33.0.3, una cookie de sesión pre-2FA (creada después de una autenticación de contraseña exitosa pero antes de la finalización de TOTP) podría ser reutilizada como un token Bearer para autenticarse contra los puntos finales DAV, otorgando acceso de lectura/escritura y eludiendo la autenticación de dos factores obligatoria. Se recomienda que el Nextcloud Server sea actualizado a 33.0.3 o 32.0.9. Se recomienda que el Nextcloud Enterprise Server sea actualizado a 33.0.3, 32.0.9, 31.0.14.5, 30.0.17.9 o 29.0.16.16

{"timestamp":"2026-06-01T19:09:58.256884Z","id":"CVE-2026-45691","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}

[{"vendor":"nextcloud","product":"security-advisories","versions":[{"version":">= 32.0.0, < 32.0.9","status":"affected"},{"version":">= 33.0.0, < 33.0.3","status":"affected"}]}]

OR
          *cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:-:*:*:* versions from (including) 32.0.0 up to (excluding) 32.0.9
          *cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:-:*:*:* versions from (including) 33.0.0 up to (excluding) 33.0.3

OR
          *cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:enterprise:*:*:* versions from (including) 29.0.0 up to (excluding) 29.0.16.16
          *cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:enterprise:*:*:* versions from (including) 30.0.0 up to (excluding) 30.0.17.9
          *cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:enterprise:*:*:* versions from (including) 31.0.0 up to (excluding) 31.0.14.5
          *cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:enterprise:*:*:* versions from (including) 32.0.0 up to (excluding) 32.0.9
          *cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:enterprise:*:*:* versions from (including) 33.0.0 up to (excluding) 33.0.3

GitHub, Inc.: https://github.com/nextcloud/security-advisories/security/advisories/GHSA-mp6x-g55j-w9jw Types: Vendor Advisory

GitHub, Inc.: https://github.com/nextcloud/server/pull/59758 Types: Issue Tracking, Patch

GitHub, Inc.: https://hackerone.com/reports/3573399 Types: Permissions Required

Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, a pre-2FA session cookie (created after successful password authentication but before TOTP completion) could be reused as a Bearer token to authenticate against DAV endpoints, granting read/write access and bypassing mandatory two-factor authentication. It is recommended that the Nextcloud Server is upgraded to 33.0.3 or 32.0.9. It is recommended that the Nextcloud Enterprise Server is upgraded to 33.0.3, 32.0.9, 31.0.14.5, 30.0.17.9 or 29.0.16.16

AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N

CWE-287

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-mp6x-g55j-w9jw

https://github.com/nextcloud/server/pull/59758

https://hackerone.com/reports/3573399