Nextcloud Server 32.0.2 → 33.0.10
24 releases · 9 breaking changes · 53 security fixes · 8 advisories fixed
53security9breaking3deprecated120feature197fix
Vulnerabilities fixed by this upgrade
- 6.8 CVE-2026-45810 Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 31.0.0 to before 31.0.12, and 32.0.0 to before 32.0.3, a missing check of a relation allowed authentica…
- 5.9 CVE-2026-45690 Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, an authentication bypass vulnerability allowed at…
- 5.9 CVE-2026-45691 Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, a pre-2FA session cookie (created after successfu…
- 8.1 CVE-2026-45281 Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, with the knowledge of other users’ principal URL…
- 6.5 CVE-2026-45282 Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, an authenticated attacker can access attachments…
- 6.4 CVE-2026-45285 Nextcloud is an open source content collaboration platform. From versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, when a user shares a folder or file with a Nextcloud Team that includ…
- 4.4 CVE-2026-45279 Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 31.0.0 to before 31.0.14, and 32.0.0 to before 32.0.4, if {lang} is used in the template directory conf…
- 5.4 CVE-2025-66512 Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server and Server Enterprise prior to 31.0.12 and 32.0.3, a missing sanitization allowed malicious users to circumvent the cont…
Breaking changes
- breaking Remove unneeded sort when listing mail/federated shares (server#60356) in 33.0.4
- breaking Debt(files): Remove regular stats request (server#56822) in 33.0.3
- breaking Remove external shares from share list (server#58717) in 33.0.1
- breaking Remove unneeded max-height from text-menubar which caused a bug (text#8351) in 33.0.1
- breaking Chore!(files_sharing): remove deprecated `OCA.Sharing.ExternalLinkActions` (server#55718) in 33.0.0
- breaking Remove stable30 from dependabot (server#56018) in 33.0.0
- breaking Debt(files): Remove regular stats request (server#56792) in 33.0.0
- breaking Enhancement(files): remove redundant success toast on file rename (server#57168) in 33.0.0
- breaking Refactor!: migrate files sidebar to Node API (server#57277) in 33.0.0
Security changes
- security Master] fix(security): Update code signing revocation list (server#64465) in 33.0.10
- security Master] fix(security): Update code signing revocation list (server#64720) in 33.0.10
- security Master] fix(security): Update code signing revocation list (server#63357) in 33.0.9
- security Master] fix(security): Update code signing revocation list (server#63363) in 33.0.9
- security Master] fix(security): Update code signing revocation list (server#63369) in 33.0.9
- security Master] fix(security): Update code signing revocation list (server#63520) in 33.0.9
- security Master] fix(security): Update code signing revocation list (server#64098) in 33.0.9
- security Master] fix(security): Update code signing revocation list (server#62653) in 33.0.8
- security Master] fix(security): Update code signing revocation list (server#62041) in 33.0.7
- security Master] fix(security): Update code signing revocation list (server#62047) in 33.0.7
- security Master] fix(security): Update code signing revocation list (server#62185) in 33.0.7
- security Master] fix(security): Update CA certificate bundle (server#62436) in 33.0.7
- security Master] fix(security): Update code signing revocation list (server#61002) in 33.0.6
- security Fix(security): don’t propagate ValueError from Crypto::decrypt() fallback (server#61104) in 33.0.6
- security Master] fix(security): Update code signing revocation list (server#61134) in 33.0.6
- security Master] fix(security): Update code signing revocation list (server#61238) in 33.0.6
- security Master] fix(security): Update code signing revocation list (server#61284) in 33.0.6
- security Master] fix(security): Update code signing revocation list (server#61430) in 33.0.6
- security Fix(security): Update Expires time (server#60396) in 33.0.4
- security Security: Unbounded `limit` parameter in user search can be abused for resource exhaustion (text#8580) in 33.0.4
- security Fixes CVE-2026-45281: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, with the knowledge of other users’ principal URL… in 33.0.3
- security Fixes CVE-2026-45282: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, an authenticated attacker can access attachments… in 33.0.3
- security Fixes CVE-2026-45285: Nextcloud is an open source content collaboration platform. From versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, when a user shares a folder or file with a Nextcloud Team that includ… in 33.0.3
- security Fixes CVE-2026-45690: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, an authentication bypass vulnerability allowed at… in 33.0.3
- security Fixes CVE-2026-45691: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, a pre-2FA session cookie (created after successfu… in 33.0.3
- security Fix(security): Update Expires time (server#54868) in 33.0.3
- security Fix(security): Update CA certificate bundle (server#54982) in 33.0.3
- security Fix(security): Update code signing revocation list (server#55051) in 33.0.3
- security Fix(security): Update code signing revocation list (server#55445) in 33.0.3
- security Fix(security): Update CA certificate bundle (server#56209) in 33.0.3
- security Fix(security): Update code signing revocation list (server#56365) in 33.0.3
- security Fix(security): Update CA certificate bundle (server#56812) in 33.0.3
- security Fixes CVE-2026-45283: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.2, and 33.0.0 to before 33.0.1, the files_lock app did not properly validate the… in 33.0.1
- security Fix(SecurityMiddleware): return header to distinguish error type (server#58880) in 33.0.1
- security [master] fix(security): Update CA certificate bundle (server#54992) in 33.0.0
- security [master] fix(security): Update code signing revocation list (server#55056) in 33.0.0
- security [master] fix(security): Update code signing revocation list (server#55446) in 33.0.0
- security [master] fix(security): Update CA certificate bundle (server#56211) in 33.0.0
- security [master] fix(security): Update code signing revocation list (server#56363) in 33.0.0
- security [master] fix(security): Update CA certificate bundle (server#56811) in 33.0.0
- security [master] fix(security): Update code signing revocation list (server#57031) in 33.0.0
- security [master] fix(security): Update code signing revocation list (server#57262) in 33.0.0
- security [master] fix(security): Update code signing revocation list (server#57380) in 33.0.0
- security Fix(security): Update Expires time (server#57688) in 33.0.0
- security Fix(security): Update code signing revocation list (server#57948) in 33.0.0
- security Fixes CVE-2026-45281: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, with the knowledge of other users’ principal URL… in 32.0.9
- security Fixes CVE-2026-45282: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, an authenticated attacker can access attachments… in 32.0.9
- security Fixes CVE-2026-45285: Nextcloud is an open source content collaboration platform. From versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, when a user shares a folder or file with a Nextcloud Team that includ… in 32.0.9
- security Fixes CVE-2026-45690: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, an authentication bypass vulnerability allowed at… in 32.0.9
- security Fixes CVE-2026-45691: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, a pre-2FA session cookie (created after successfu… in 32.0.9
- security Fixes CVE-2026-45279: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 31.0.0 to before 31.0.14, and 32.0.0 to before 32.0.4, if {lang} is used in the template directory conf… in 32.0.4
- security Fixes CVE-2026-45810: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 31.0.0 to before 31.0.12, and 32.0.0 to before 32.0.3, a missing check of a relation allowed authentica… in 32.0.3
- security Fixes CVE-2025-66512: Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server and Server Enterprise prior to 31.0.12 and 32.0.3, a missing sanitization allowed malicious users to circumvent the cont… in 32.0.3
Deprecations
- deprecated Fix – Replaced deprecated QueryBuilder `execute()` (privacy#1268) in 33.0.1
- deprecated Port away from deprecated Doctrine APIs (server#55674) in 33.0.0
- deprecated Cleanup unused code and deprecated imports (text#7752) in 33.0.0
Every release in between
fixFix: track time spent in recursive markOrRun calls (server#61552)
fixFix(dashboard): update scrollbar contrast on background (server#62629)
fixFix(encryption): bind personal private key password inputs (server#62671)
fixFix: allow Enter on public share Download link (server#62769)
fixFix: multiple file selection on tab navigation (server#63213)
fixFix(cardDav): Only update user card on actual mapped propreties changes (server#63769)
fixFix: fail uploads when uri does not match session/share token (server#63961)
fixFix(files_external): map display names for groups (server#64009)
fixFix: Unknown cli option (server#64012)
fixFix(sharing): Hide Allow download and sync option for federated (server#64014)
fixFix(tags): broken tag deletion on user delete (server#64088)
fixFix: protect share accept endpoint with CSRF token (server#64108)
fixFix: remove wrongly used system address book flag (server#64130)
fixFix(files_sharing): normalize share target on parent folder rename (server#64142)
fixFix(files_sharing): don’t abort share:list when orphaned shares exist (server#64147)
fixFix: update left padding of public shares (server#64211)
fixFix(ci): Pin 32-bit (server#64305)
fixFix(sharing): Use link_defaultExpDays for default expiration in web UI (server#64320)
fixFix: preserve link shares on ownership transfer (server#64329)
fixFix: remove nested items from favorites view on unfavorite (server#64346)
fixFix(encryption): cap and invalidate key-cache (server#64354)
fixFix(files): Show confirmation dialog on delete hotkey press (server#64358)
fixFix(files_external): show that an unrestricted storage applies to all (server#64360)
fixFix(files_sharing): don’t crash CleanupShareTarget when mount info is missing (server#64366)
fixFix: show custom permissions when share is removed from edit bundle (server#64377)
fixFix: logs can leak sensitive information.. (server#64384)
fixFix(files_sharing): only offer folders in file-request which are shareable (server#64414)
fixFix: scope group share child permission updates to usergroup (server#64418)
fixFix: Send password to owner when password sending fails, regardless of enforcement (server#64423)
fixFix(config): Don’t print sensitive config when setting them (server#64463)
securityMaster] fix(security): Update code signing revocation list (server#64465)
fixFix: keep share visible for share owner when iinitiator is deactivated (server#64475)
fixFix(files_sharing): cap share presets to the permissions the resharer (server#64480)
fixFix(encryption): keep version and size in sync for files not in the cache (server#64483)
fixFix(dav): keep tags on hidden files when setting tag object ids (server#64561)
featureAdd API to generate system report section (server#64633)
securityMaster] fix(security): Update code signing revocation list (server#64720)
featureFeat: add additional metadata to node webhooks (server#64845)
featurePerf(files): Only match search results against caches of their storage (server#64918)
featureFeat(workflow): Add fixup block (circles#2987)
+76 more items in the release notesfixFix(ocm): Move invite-accepted capability and implementati… (server#62460)
fixFix(Database): Use real idle-timer to prevent `lastInsertId` being reset on MariaDB/MySQL (server#62713)
featureFeat(oauth2): Forward app tokens from primary to secondary in global scale (server#63156)
fixFix(CalDAV): iTipBroker message generation and testing (server#63187)
fixFix(preview): delete version metadata by preview ID (server#63289)
fixFix(iMIP): Prevent mails from carrying an unrelated user’s name (server#63309)
fixFix: make unified filter chip accessible (server#63319)
fixFix(preview): qualify the ambiguous columns in PreviewMapper queries (server#63346)
securityMaster] fix(security): Update code signing revocation list (server#63357)
securityMaster] fix(security): Update code signing revocation list (server#63363)
securityMaster] fix(security): Update code signing revocation list (server#63369)
fixFix(user_ldap): restore OCS API functionality for configID = ‘’ (server#63377)
fixFix: allow file request upload when `part_file_in_storage=false` (server#63380)
fixFix: Public link with multiple mounts (server#63383)
fixFix(preview): keep the local file when losing the insert race (server#63391)
fixFix(files_sharing): Use share password policy for password generation (server#63396)
fixFix one core migration: Only add taskprocessing columns if they don’t exist (server#63405)
fixFix(files_reminder): passed reminder handling (server#63424)
fixFix(files_external): set usePresignedUrl before first S3 connection (server#63457)
securityMaster] fix(security): Update code signing revocation list (server#63520)
fixFix(preview): execute PreviewMapper::deleteAll() (server#63522)
fixFix(files): hide download action in link shares for newly created folders (server#63553)
fixFix(appconfig): make type-conflict error self-explanatory (server#63642)
fixFix(dav): scope contact photo export to local address books (server#63644)
fixFix cancelling the customization of a share (server#63657)
fixFix(dav): correctly mask public v1 links for non-home storages (server#63667)
fixFix(dav): only derive the write size from a PUT Content-Length (server#63677)
fixFix(settings): Fix AI regex (server#63692)
fixFix: Check that password matches in occ user:auth-tokens:add (server#63696)
fixFix(contactsmenu): restore avatars for non-user contacts (server#63716)
fixFix: Check rememberme cookie previous session id matches uid (server#63720)
fixFix(2fa): Add missing BruteForceProtection attribute (server#63733)
fixFix(core): accept deprecated IANA timezone aliases (server#63757)
fixFix(group): pass previous display name in GroupChangedEvent (server#63780)
fixFix(files_external): guard optional S3 key in storage id computation (server#63818)
fixFix(webauthn): Throw on uid mismatch when updating registration (server#63833)
fixFix: Correctly filter users when the backend does not implement ISearchKnownUsersBackend (server#63842)
fixFix: Ensure we don’t get share by empty name (server#63851)
securityMaster] fix(security): Update code signing revocation list (server#64098)
featureAdd a vitest harness for the front-end (files_pdfviewer#1566)
+40 more items in the release notesfixFix(files_sharing): preserve unmasked permissions as scan_permissions (server#62217)
featurePerf: Replace more calls from getUserGroups to getUserGroupIds (server#62222)
fixFix: Output shape validation will delete keys when there is a list of files (server#62238)
fixFix(files_external/SMB): Use ‘null’ explicitly for no workgroup (server#62280)
fixFix(files): properly handle folders without permissions (server#62319)
fixFix(files): preserve encryptedVersion when copying cache entries (server#62338)
fixFix(files_version): mtime confusion on milliseconds (server#62371)
fixFix(files_sharing): Use share id in file actions (server#62402)
fixFix(AmazonS3): pass S3 error messages through to the frontend (server#62419)
fixFix(SetupChecks): Link to task processing worker docs (server#62442)
fixFix: Don’t add empty and broken ExternalShareScanJob on upgrade (server#62452)
fixFix(background-jobs): preserve Snowflake IDs as strings (server#62456)
fixFix: harden object store against copying a file to itself (server#62462)
featurePerf(preview): Optimize retriving all previews from oc_filecache (server#62603)
fixFix(unified-search): catch errors in response (server#62614)
securityMaster] fix(security): Update code signing revocation list (server#62653)
fixFix(search): Add end date for last 7 and last 30 days (server#62684)
fixFix(caldav): Expand recurring events for principal calendar search (server#62692)
fixFix(MemcachedFactory): Enable TCP_NODELAY and adjust default timeouts to be reasonable (server#62703)
fixFix(imip): add context to imip log messages (server#62721)
fixFix(share-api-controller): add sanity check on canAccessShare for circle share types (server#62732)
featurePerf(user-display-name): Check memory cache before trying redis (server#62777)
fixFix(encryption): Correctly report size for zero-byte encrypted files (server#62779)
fixFix(provisioning_api): read newUser.sendEmail as a boolean (server#62785)
fixFix(encryption): handle decryption exception with outdated passwords (server#62787)
fixFix(imip): don’t report success when a calendar cannot process iMip (server#62793)
fixFix(systemTags): setObjectIdsForTag() dispatches once (server#62800)
fixFix: handle sftp private key as password (server#62823)
fixFix: disable direct link if link shares are disabled (server#62831)
fixFix: clear key password after loading key (server#62849)
fixFix(direct editing): cleanup tokens on user deletion (server#62863)
fixFix(dav): properly finalize with MOVE only (server#62875)
fixFix(share): do not re-accept rejected shares (server#62890)
fixFix: throw better error message if a user doesn’t have a key even though it should have (server#62892)
featureFeat: Add setting to bypass password confirmation on a selected ip ranges (server#62907)
featureFeat: Allow to check user existence outside specific user backends (server#62916)
featureFeat(lookup): search for local account only via lookupserver (server#62935)
featureFeat: allow specifying applicable users and groups in the files_external:create command (server#62948)
featureFeat(federation): Add accept/decline mechanism for federated calendars (server#63115)
featureFeat: adding an option to exclude users from the acitivity log (activity#2809)
+62 more items in the release notesfixFix(files_sharing): Drop trailing ‘?’ from public download redirect URL (server#59885)
fixFix(settings): sort app list by app name instead of app objects (server#59992)
fixFix(cypress): disable unsupported-browser redirect in test container (server#60805)
fixFix(core): public share download icon color and theme filter scope (server#61210)
fixFix: update cached mounts when moving share in repair step (server#61499)
fixFix(files_sharing): remove filename’s leading slash on unshare toast (server#61527)
featurePerf: block more properties from using the custom properties backend (server#61541)
fixFix(settings): correct heading order in account management sidebar (server#61547)
fixFix: Make the IProvideUserSecretBackend usable (server#61549)
featurePerf(log): normalize log data only when logging (server#61556)
fixFix(Collaborators): Fix matching emails to remote users if no remote results are present (server#61570)
fixFix(dav): Handle GenericFileException when reading default contact file (server#61595)
fixFix(a11y): label account QR code button (server#61603)
fixFix(files): Open the sidebar for the current folder, not a stale child (server#61605)
fixFix(user_status): stabilise the user_status (server#61619)
fixFix(dav): Load ProfilerPlugin only when profiler is enabled (server#61644)
fixFix(config): Decrypt sensitive appconfigs when requested (server#61661)
fixFix(files_external): ignore deprecated backends (server#61692)
fixFix(files_external): properly apply default mount options (server#61701)
fixFix(settings): in absence form avoid shifting dates to browsers timezone (server#61711)
featurePerf: Only sort wrappers when adding them (server#61718)
featurePerf: Don’t fetch full group object in AuthorizedGroupMapper (server#61851)
featureFeat: Disable callable serialization in sabre/xml (server#61924)
featureFeat: Fetch groups in batch in getUserGroups (server#61935)
featureFeat(login): clean remember me tokens (server#61971)
securityMaster] fix(security): Update code signing revocation list (server#62041)
securityMaster] fix(security): Update code signing revocation list (server#62047)
featurePerf(carddav): reduce disk usage of photocache (server#62053)
featurePerf(workflow): Implement result cache for IP checks (server#62056)
featurePerf: Don’t fetch all the trash items when deleting a single item (server#62179)
securityMaster] fix(security): Update code signing revocation list (server#62185)
featureFeat(files_sharing): schedule external share scan job when accepted (server#62198)
featurePerf(dav): Stream PROPFIND output (server#62225)
securityMaster] fix(security): Update CA certificate bundle (server#62436)
featureFeat: Disable callable serialization in sabre/xml (3rdparty#2512)
featureFeat: make amount of items sent on email configurable via occ (activity#2709)
featurePerf(files): compute move/rename activity settings once (activity#2795)
featureFeat: add release relay gh workflow (app_api#923)
featureFeat: Show request time to the push proxy (notifications#3155)
featureFeat: Add login output when password policy fails (password_policy#967)
+249 more items in the release notesfixDav: Fix fatal error when ORGANIZER is missing in CalDAV schedule (server#59350)
fixFix(files,files_sharing): swallow redirected navigation errors (server#59887)
fixFix(caldav): grant sharee Acls to the delegate (server#60646)
fixFix(http): avoid iconv for header ascii fallback (server#60722)
fixFix(DB): Enforce foreign key constraints in SQLite (server#60792)
fixFix(encryption): recovery keys should be shown when user keys are used (server#60799)
fixFix(appconfig,userconfig): restore pre-migration fallback for ownCloud migration (server#60819)
fixFix(files): Chromium-based browsers drag-and-drop (server#60899)
fixFix: actually register listener for updating stored external storage credentials (server#60905)
fixFix(MailPlugin): Stop applying the offset twice and the limit per wide/exact (server#60920)
fixFix(sharing): set STATUS_ACCEPTED when creating USERGROUP subshare on… (server#60925)
fixFix(Share): Add missing optional parameter to IManager::shareApiAllowLinks() (server#60928)
fixFix(psalm): Update psalm baseline (server#60933)
fixFix(Storage): use `proxyexclude` parameter in DAV client (server#60939)
fixFix(files_sharing): clear the password after saving (server#60951)
fixFix(files): show proper information when a move will override the target (server#60962)
fixFix: access shared and delegated trashbin objects (server#60967)
fixFix(TaskProcessing): restrict allowed_classes in Manager cache deserialization (server#60984)
securityMaster] fix(security): Update code signing revocation list (server#61002)
fixFix(dav): finalize upload metadata before post-write hooks (server#61070)
fixFix(dav): properly handle files metadata (server#61079)
fixFix(comments): Use capped memory cache for comments (server#61096)
securityFix(security): don’t propagate ValueError from Crypto::decrypt() fallback (server#61104)
fixFix(files): make sure nested changes are propagated to sidebar tabs (server#61107)
fixFix: Correctly detect appid for dist css files (server#61112)
fixFix: use correct permissions mask for non-home storage public links (server#61117)
fixFix(settings): Show loading spinner while searching accounts (server#61121)
securityMaster] fix(security): Update code signing revocation list (server#61134)
featureFeat(file-search): add property to SearchQuery and check select fields to decide wheter to join extended cache (server#61156)
fixFix(previews): ffprobe hangs (server#61183)
fixFix(files_versions): guard null path in event listeners (server#61188)
fixFix(SetupChecks): maintenance window length is 4h (not 6h) (server#61192)
fixFix(search-query): fix psalm type error (server#61196)
securityMaster] fix(security): Update code signing revocation list (server#61238)
fixFix(encryption): Fix endpoint /ajax/userSetRecovery to support boolean (server#61242)
securityMaster] fix(security): Update code signing revocation list (server#61284)
featureFeat(oauth2): Add commands for adding and deleting clients (server#61362)
securityMaster] fix(security): Update code signing revocation list (server#61430)
featurePerf(mailqueue): cover `amq_latest_send` in the affecteduser index (activity#2637)
featureFeat: Add role-based filtering for circle member queries (circles#2504)
+48 more items in the release notesotherRefactor: move release changelog workflow to releases repo (server#60831)
fixFix: Add missing DI for IAppConfig to Push.php (notifications#3039)
fixFix(folderDescription): always use ‘Readme.md’ as filename (text#8658)
fixFix(headings): skip headings in details in table of contents (text#8660)
otherTest(playwright): add summary job so we can add it to merge rules (text#8663)
fixFix: allow renaming files with just update permissions (server#59241)
fixFix(encryption): limit oprhaned keys scan to one user (server#59808)
fixFix(s3): ignore prefixes with repeating delimiters (server#59829)
fixFix removed address book items not being synced between federated instances (server#59894)
fixFix(files): fix custom client-side error messages on move/copy actions (server#59954)
featureFeat: Better reporting if something is wrong with taskprocessing (server#59991)
fixFix: Harmonize login and passwordless login redirect behavior (server#60007)
fixFix(core): provide valid initial state also on public templates (server#60015)
fixFix(navigation): Fix default app icon (server#60133)
fixFix(files): escape html entities in dav search requests (server#60140)
fixFix(LocalPreviewStorage): Use correct regex to detect files in nested directory format (server#60143)
fixFix(comments): register event listener for typed comment events (server#60149)
fixFix(core): use btoa() instead of window.Buffer.from() for base64 encoding (server#60157)
fixFix: Dispatch old comment events (server#60168)
fixFix(comments): Add an action to comment notification that dismisses it (server#60175)
fixFix(core): prompt for password once when installing recommended apps (server#60184)
featureFeat(updatenotification): handle files_lock (server#60203)
fixFix(public.scss): increase footer width (server#60208)
fixFix: correct typo ‘occured’ to ‘occurred’ in SetupCheckManager (server#60210)
fixFix since checker (server#60219)
fixFix(settings): Fix admin delegation for hidden sections (server#60222)
fixFix: Fix permission issue when uploading a chunked file (server#60240)
featureFeat(app-licenses): Add further compatible licenses for apps to use (server#60296)
fixFix(Setup): Ensure instanceid is generated during installation (server#60301)
fixFix(http-client): detect brotli support via libcurl, not PHP extension (server#60309)
fixFix(s3): Add Content-MD5 header for DeleteObjects to fix AWS SDK v3.339.0+ compatibility (server#60322)
fixFix(snowflake): fix wrong documentation about serverId (server#60328)
featurePerf(share): Remove useless order by id (server#60345)
breakingRemove unneeded sort when listing mail/federated shares (server#60356)
featurePerf: remove unneeded sort in getFolderContentsById (server#60357)
securityFix(security): Update Expires time (server#60396)
featureFeat(users): Check assertion when enabling user (server#60516)
featureEnh(occ): make it possible to add an arbitrary number of users to a g… (server#60601)
featureFeat(openmetrics): export more resilient if exception happens (server#60627)
featureFeat: add search and limit support for team members list (circles#2460)
featureFeat: Remove unnecessary whitespaces (logreader#2027)
featureFeat(push): Optionally use OAEP padding (notifications#2986)
featurePerf(rich_workspace): only add property for parent (text#8498)
featureFeat: add support for wiki-style link and image Markdown syntax (text#8576)
securitySecurity: Unbounded `limit` parameter in user search can be abused for resource exhaustion (text#8580)
+86 more items in the release notessecurityFixes CVE-2026-45281: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, with the knowledge of other users’ principal URL…
securityFixes CVE-2026-45282: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, an authenticated attacker can access attachments…
securityFixes CVE-2026-45285: Nextcloud is an open source content collaboration platform. From versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, when a user shares a folder or file with a Nextcloud Team that includ…
securityFixes CVE-2026-45690: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, an authentication bypass vulnerability allowed at…
securityFixes CVE-2026-45691: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, a pre-2FA session cookie (created after successfu…
featureFeat(migration-attributes): add DataCleansing (server#54861)
featureFeat(SystemTag): Add typed events for tag mapper events (server#54863)
securityFix(security): Update Expires time (server#54868)
featureAdd task processing manager method to get the list of available task type IDs (server#54917)
featureFeat(file_sharing): Provide template creator list in public shares (server#54948)
featureFeat: show object store instance in info:file (server#54961)
featureFeat(files_trashbin): Refactor expire background job to support parallel run (server#54967)
featurePerf(mounts): avoid array_merge in mounts loop (server#54976)
securityFix(security): Update CA certificate bundle (server#54982)
featureFeat(ZipFolderPlugin): always use the parent folder name as archive name (server#55020)
securityFix(security): Update code signing revocation list (server#55051)
featureFeat(encryption): Add integration tests for occ commands and fix them (server#55060)
featureFeat(files_sharing): provide web components based API for sidebar (server#55174)
featureFeat(db): add SSL/TLS support for PostgreSQL (server#55256)
featureFeat(Unified search): Use existing min search length setting (server#55301)
featureFeat: Mark OC.SystemTags as deprecated (server#55323)
featureAdmin-delegation occ – add output option for show command to support JSON formats (server#55430)
securityFix(security): Update code signing revocation list (server#55445)
featureFeat: add header with user id in response (server#55502)
featureAllow to remove a website in the user profile (server#55523)
featureFeat(test-case): allow to use PHPUnit Group attributes to mark tests requiring database (server#55571)
featureFeat(settings): Introduce TaskProcessingSuccessRate setup check (server#55778)
featureFeat: add new link endpoint when using globalscale (server#55798)
featureFeat(route): globalsiteselector as root url generator (server#55817)
featureFeat: locally cache frequently requested LDAP mapping data (server#55823)
featureAdd font-variant-numeric to selected files list (server#55873)
featureAdd unit tests for AdminDelegation command and AuthorizedGroupService (server#56044)
securityFix(security): Update CA certificate bundle (server#56209)
featureFeat(EphemeralSessions): Introduce lax period (server#56232)
featureFeat(cloud-federation-api): accept folder shares (server#56336)
featureFeat: add occ command to scan and delete orphaned keys (server#56347)
securityFix(security): Update code signing revocation list (server#56365)
featureAdd AI input limits (server#56369)
featureFeat(rate-limit): Allow overwriting the rate limit (server#56382)
featureAdd rememberme checkbox (server#56423)
+732 more items in the release notesotherserver
featureFeat(recent-files): add recent_files_limit config on files settings (server#59216)
other33.0.2 RC0 (server#59259)
fixFix(files_sharing): do not prevent share creation if password is enabled but not supported by the current share type (server#59263)
fixFix(sharing): Don’t redirect when accepting a share failed (server#59305)
other33.0.2 RC1 (server#59306)
other33.0.2 (server#59392)
otheractivity
otherChore(branchoff): Set version on stable33 to a stable one (activity#2480)
otherbruteforcesettings
otherChore(branchoff): Set version on stable33 to a stable one (bruteforcesettings#1032)
otherUpdate nextcloud/ocp dependency (bruteforcesettings#1038)
otherfiles_downloadlimit
otherChore(branchoff): Set version on stable33 to a stable one (files_downloadlimit#756)
otherfiles_pdfviewer
otherChore(branchoff): Set version on stable33 to a stable one (files_pdfviewer#1401)
otherfirstrunwizard
otherChore(branchoff): Set version on stable33 to a stable one (firstrunwizard#2020)
otherpassword_policy
otherChore(branchoff): Set version on stable33 to a stable one (password_policy#914)
otherphotos
otherChore(branchoff): Set version on stable33 to a stable one (photos#3459)
otherprivacy
otherChore(branchoff): Set version on stable33 to a stable one (privacy#1289)
otherrecommendations
otherChore(branchoff): Set version on stable33 to a stable one (recommendations#1004)
otherrelated_resources
otherChore(branchoff): Set version on stable33 to a stable one (related_resources#907)
otherserverinfo
otherChore(branchoff): Set version on stable33 to a stable one (serverinfo#967)
othersurvey_client
otherChore(branchoff): Set version on stable33 to a stable one (survey_client#391)
othersuspicious_login
otherChore(branchoff): Set version on stable33 to a stable one (suspicious_login#1092)
othertext
fixFix(deps): update dependency yjs to ^13.6.30 (text#8394)
otherChore(branchoff): Set version on stable33 to a stable one (text#8407)
othertwofactor_totp
otherChore(branchoff): Set version on stable33 to a stable one (twofactor_totp#1751)
fixFix(deps): align composer-lock and checked-in vendor/ (updater#727)
+3 more items in the release notessecurityFixes CVE-2026-45283: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.2, and 33.0.0 to before 33.0.1, the files_lock app did not properly validate the…
fixFix(docs): Fix dead documentation link for Windows file names (server#58291)
fixFix(comments): properly handle opening the sidebar when Activity integration is used (server#58294)
fixFix(theming): display error messages on image upload and delete previous image only after validation (server#58323)
fixFix: don’t try to create preview folder if it already exists (server#58328)
fixFix: obey x-nc-scheduling flag on delete (server#58341)
fixFix(sftp): Handle empty port parameter to allow host-defined ports (server#58358)
featureFeat: add upload_time support to file search and recent files (server#58374)
fixFix(files): correctly sort views (server#58375)
fixFix(cache): filter out invalid entries in `OC\Files\Cache\Wrapper\CacheWrapper::getFolderContentsById` (server#58378)
fixFix(setup): add index properties_name_path_user by default on new installs (server#58418)
fixFix(external_storage): hide local storage as an option for users (server#58424)
fixFix(user_status): mount emoji picker outside of dialog (server#58429)
fixFix(perf): use index when deleting old previews (server#58431)
fixFix(Propagator): Skip groupfolders root entries (server#58433)
fixFix/more missing userid cases (server#58440)
fixFix(files_sharing): ensure the server share API errors are shown (server#58441)
fixFix(TransferOwnershipService): Remove groupfolders size (server#58449)
fixFix(Propagator): Also skip groupfolders versions and trash entries (server#58450)
fixFix(View): Handle ICacheEntry returned by FileInfo->getData() (server#58455)
fixFix(files): fix tab navigation from select all checkbox to batch actions (server#58462)
fixFix(files_sharing): make legacy `downloadShare` endpoint compatible with legacy behavior (server#58468)
fixFix(dav): Use an exhaustive list for allowed serialized classes (server#58511)
featureFeat: calendar read and write federation (server#58590)
featurePerf(sharing): Avoid loading all shares from all users when unsharing (server#58658)
featureFeat: set creation_time on file creation and render recently created icon (server#58694)
breakingRemove external shares from share list (server#58717)
featurePerf(preview): bulk process preview regeneration (server#58796)
featureFeat: Add memcache_customprefix (server#58810)
featureFeat(routing): add files_sharing_raw to rootUrlApps (server#58838)
securityFix(SecurityMiddleware): return header to distinguish error type (server#58880)
featureFeat: improve calendar migrator (server#58907)
featureFeat(CalDAV): Add function to get the token of a publicly shared calendar (server#59080)
featureFeat(taskprocessing): add worker command for synchronous task processing (server#59082)
featurePerf: Replace getById call with getFirstNodeById (activity#2388)
featurePerf: add new index to serve a full WHERE clause (activity#2447)
featureFeat: make Docker API version configurable via app config (app_api#798)
featureAvoid cropping logo in About & New slideshow (firstrunwizard#1964)
featureFeat(api): Add context parameter to generate and validate endpoints (password_policy#900)
deprecatedFix – Replaced deprecated QueryBuilder `execute()` (privacy#1268)
+137 more items in the release notesfeatureAdd UserConfigChangedEvent to fire whenever a user config value is changed (server#42039)
featureFeat: Add appconfig to disable fixed userfolder permissions optimization (server#51145)
featureFeat: add an option to filter what paths get checked for updates (server#52442)
featureFeat(CertificateManager): Add option to specify the default certificates bundle path (server#52749)
featureFeat(files_trashbin): Refactor expire background job to support parallel run (server#52825)
featureFeat(previews): allow ffmpeg to connect direct for AWS S3 buckets (server#53634)
featureFeat(login): hide password on form submit (server#53869)
featureFeat(previews): previews for large remote files without full file download (server#53952)
featureFeat(encryption): Add integration tests for occ commands and fix them (server#54316)
featureFeat: locally cache frequently requested LDAP mapping data (server#54429)
featurePerf(s3): Provide direct pre-signed download link (server#54436)
featureAdd INodeByPath to Directory (server#54441)
featureFeat(config): Add common audio and video MIME type aliases (server#54447)
featurePerf(preview): Split preview data to new table (server#54543)
featureFeat(file_sharing): Provide template creator list in public shares (server#54565)
featureFeat(comments): add Markdown support (server#54685)
featureFeat(files_sharing): provide web components based API for sidebar (server#54788)
featureFeat(ObjectStore): Add option to limit the total size (server#54797)
featureFeat(SystemTag): Add typed events for tag mapper events (server#54810)
featureFeat(migration-attributes): add DataCleansing (server#54842)
featureFeat(migration-attributes): missing attributes (server#54846)
featureAdd task processing manager method to get the list of available task type IDs (server#54848)
security[master] fix(security): Update CA certificate bundle (server#54992)
security[master] fix(security): Update code signing revocation list (server#55056)
security[master] fix(security): Update code signing revocation list (server#55446)
deprecatedPort away from deprecated Doctrine APIs (server#55674)
breakingChore!(files_sharing): remove deprecated `OCA.Sharing.ExternalLinkActions` (server#55718)
breakingRemove stable30 from dependabot (server#56018)
security[master] fix(security): Update CA certificate bundle (server#56211)
security[master] fix(security): Update code signing revocation list (server#56363)
breakingDebt(files): Remove regular stats request (server#56792)
security[master] fix(security): Update CA certificate bundle (server#56811)
security[master] fix(security): Update code signing revocation list (server#57031)
breakingEnhancement(files): remove redundant success toast on file rename (server#57168)
security[master] fix(security): Update code signing revocation list (server#57262)
breakingRefactor!: migrate files sidebar to Node API (server#57277)
security[master] fix(security): Update code signing revocation list (server#57380)
securityFix(security): Update Expires time (server#57688)
securityFix(security): Update code signing revocation list (server#57948)
deprecatedCleanup unused code and deprecated imports (text#7752)
+2364 more items in the release notessecurityFixes CVE-2026-45281: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, with the knowledge of other users’ principal URL…
securityFixes CVE-2026-45282: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, an authenticated attacker can access attachments…
securityFixes CVE-2026-45285: Nextcloud is an open source content collaboration platform. From versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, when a user shares a folder or file with a Nextcloud Team that includ…
securityFixes CVE-2026-45690: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, an authentication bypass vulnerability allowed at…
securityFixes CVE-2026-45691: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, a pre-2FA session cookie (created after successfu…
securityFixes CVE-2026-45279: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 31.0.0 to before 31.0.14, and 32.0.0 to before 32.0.4, if {lang} is used in the template directory conf…
securityFixes CVE-2026-45810: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 31.0.0 to before 31.0.12, and 32.0.0 to before 32.0.3, a missing check of a relation allowed authentica…
securityFixes CVE-2025-66512: Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server and Server Enterprise prior to 31.0.12 and 32.0.3, a missing sanitization allowed malicious users to circumvent the cont…