Expired50% confidenceFactExact time
Nextcloud version 26.4.303 was released only two days before the blogger discovered the intrusion, and the changelog did not flag it as a security fix.
1
Sources
50%
Confidence
Short-term (~14 days)
Relevance
9/14/2026
First Seen
Valid until: 9/28/2026(expired)
Sources
Related Entities
Related Claims
UnverifiedThe CVE advisory states that the vulnerability was fixed 10 months ago in Nextcloud version 25.4.703.76% similarUnverifiedVersion 2.0.26 is a patch update (Patch Changes).62% similarUnverifiedThe new version fixed credential leakage risks where /ultrareview and local cloud sessions could upload uncommitted prod.env, *.tfvars files, as well as editor temporary files and backup credential files; these files will now remain local and no longer be uploaded.61% similarUnverifiedVersion v2.1.252 introduces no new features and focuses on fixing four critical bugs61% similarUnverifiedDatasette released version 0.65.4, a maintenance release focused on security fixes.61% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/919682API
curl https://kongchang.com/api/v1/knowledge/claims/919682MCP
get_claim(id=919682)