An unauthorized proxy-assignment flaw in Nextcloud's CalDAV implementation that lets any low-privileged user take full control of another user's calendars - including the administrator's.

Nextcloud uses a CalDAV/CardDAV stack that exposes a rich set of DAV methods like MKCALENDAR, PROPFIND, PROPPATCH, REPORT over `/remote.php/dav/`. So, any authenticated user can talk to these endpoints, implementing a robust backend authorization layer is critical.

While probing that authorization layer, Hackian found that a regular, non-administrative account could grant itself write access to another user's calendars by issuing a single PROPPATCH request. This results in a full cross-account calendar takeover.

Nextcloud assigned it CVE-2026-45281 and fixed it in their April 2026 maintenance releases.

This post walks through how we found the finding including the false start that pointed us in the right direction, the root cause, and a working proof of concept.

Technical Analysis

In CalDAV, every user is represented by a principal. Each principal also owns two automatically-created sub-principals used for delegation:

.../principals/users/<user>/calendar-proxy-read

.../principals/users/<user>/calendar-proxy-write

These are group principals. Their membership is stored in the {DAV:}group-member-set property. Once you are a member, you can read and write every calendar that the user owns.

The security of the whole scheme therefore rests on one assumption:

• only the owner of a principal (or an administrator) may modify that principal's proxy groups.
• If any authenticated user can write to `admin/calendar-proxy-write`'s `group-member-set`, they can simply add themselves and inherit full access to the admin's calendars.

That is exactly what happens.

Root Cause

The vulnerability is a single missing authorization check:

Low-privileged accounts can issue a PROPPATCH against the admin’s calendar-proxy-write, setting {DAV:}group-member-set to point at itself.

Nextcloud's backend accepted that update without verifying that the authenticated user is the owner. So, any authenticated user could therefore write themselves into any other user's proxy-write group, and from that point on act as a legitimate write-proxy for the victim.

Disclosure Timeline

2026-02-09 - Reported to Nextcloud

2026-02-09 - First Nextcloud response

2026-04-30 - Fixed in Nextcloud's latest maintenance releases; report resolved

2026-05-12 - CVE-2026-45281 assigned

Severity: High

CVE: CVE-2026-45281

Security Advisor: https://github.com/nextcloud/security-advisories/security/advisories/GHSA-hrrv-mp25-26vv

Affected versions:

Nextcloud Server < 33.0.3, < 32.0.9, etc. (Enterprise Server back to 21.x).