CVE-2026-77165

MediumCVSS 6.5/10Last modified Sep 22, 2026

Description

File owners were unable to unlock TYPE_TOKEN locks placed by other users, leaving files permanently locked with no recovery path outside of the database.

Metrics

CVSS 3.0 6.5/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-284

Affected software

Vendor	Product	Versions
Nextcloud	Server	>= 32.0.0, <= 34.0.0

References

Timeline

Published: Sep 21, 2026
Last modified: Sep 22, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-771662.4The emoji field in the page emoji update endpoint does not properly validate user input. By injecting long text and line breaks, the sidebar CVE-2026-771677.5Abusing the federated share endpoint, an attacker can write arbitrary rows into the oc_share_external database table. These rows persist ind CVE-2026-771684.3A cross-site request forgery vulnerability in tracker-invocation.php in Revive Adserver 6.0.8 and earlier allows an attacker to modify a tra CVE-2026-771696.5A vulnerability in the team folders (formerly group folders) app when used in combination with the workspace app allowed API/REST-only deleg CVE-2026-77178.8A vulnerability was determined in Totolink WA300 5.2cu.7112_B20190227. This issue affects the function UploadCustomModule of the file /cgi-b CVE-2026-771704.3The Deck config API allows authenticated users to set board-scoped configuration keys for arbitrary board IDs without validating whether the CVE-2026-771713.5A public shared collective always allowed recipients of the link to create pages.CVE-2026-771725.3App passwords were allowed to bypass password confirmation on sensitive endpoints.CVE-2026-771734.3A user could create a docx or odt file with a # in the filename with confidential information such as a credit card number and have it not b CVE-2026-771768.1A flaw was found in Kata Containers. In configurations utilizing genpolicy for Confidential Containers guest protection, a malicious host op CVE-2026-771779.8Open GenAI Stack (aka ogx-ai) 2026-06-11, as used in the Meta AI backend for WhatsApp and other products, allows code execution because prom CVE-2026-771789.1Oracle VM VirtualBox before 7.2.8 allows guest OS users to cause an out-of-bounds write in the host OS in pcnetReceiveNoSync in DevPCNet.cpp