CVE-2023-45150

Nextcloud calendar is a calendar app for the Nextcloud server platform. Due to missing precondition checks the server was trying to validate strings of any length as email addresses even when megabytes of data were provided, eventually making the server busy and unresponsive. It is recommended that the Nextcloud Calendar app is upgraded to 4.4.4. The only workaround for users unable to upgrade is to disable the calendar app.

• CWE-400
• CWE-354

• https://github.com/nextcloud/calendar/pull/5358Patch
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-r936-8gwm-w452Vendor Advisory
• https://hackerone.com/reports/2058337Exploit, Issue Tracking
• https://github.com/nextcloud/calendar/pull/5358Patch
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-r936-8gwm-w452Vendor Advisory
• https://hackerone.com/reports/2058337Exploit, Issue Tracking

Published

Oct 16, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-45145Redis is an in-memory database that persists on disk. On sta…3.6
• CVE-2023-45146XXL-RPC is a high performance, distributed RPC framework. Wi…10
• CVE-2023-45147Discourse is an open source community platform. In affected …3.1
• CVE-2023-45148Nextcloud is an open source home cloud server. When Memcache…4.3
• CVE-2023-45149Nextcloud talk is a chat module for the Nextcloud server pla…4.3
• CVE-2023-4515In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2023-45151Nextcloud server is an open source home cloud platform. Affe…8.8
• CVE-2023-45152Engelsystem is a shift planning system for chaos events. A B…2.3
• CVE-2023-45158An OS command injection vulnerability exists in web2py 2.24.…9.8
• CVE-2023-451591E Client installer can perform arbitrary file deletion on p…8.4
• CVE-2023-4516 A CWE-306: Missing Authentication for Critical Function vul…7.8
• CVE-2023-45160In the affected version of the 1E Client, an ordinary user c…8.8