CVE-2026-77166
CVSS Score
2.4
EPSS Score
0.0%
EPSS Percentile
0th
The emoji field in the page emoji update endpoint does not properly validate user input. By injecting long text and line breaks, the sidebar layout becomes broken and can hide other items.
| CWE | CWE-840 |
| Vendor | nextcloud |
| Product | collectives |
| Published | Sep 21, 2026 |
Stay Ahead of the Next One
Get instant alerts for nextcloud collectives
Be the first to know when new low vulnerabilities affecting nextcloud collectives are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N Affected Versions
Nextcloud / Collectives
3.2.1 ≤ 3.5.0
Credits
_dha (yoyomiski)