In its October 15, 2026, blog post, Collabora said GitHub’s CVE-processing backlog had grown from about a day to many weeks and that it was applying to become a CVE Numbering Authority (CNA) so it could submit CVEs directly. The delayed advisory concerns CVE-2026-110447 in Nextcloud’s optional richdocumentscode app. Collabora advises administrators to update the app to version 26.4.303 or later, or remove it; disabling it alone is insufficient, according to the security advisory published October 14.
Collabora also said its team had reviewed, processed, fixed and shipped around ten years’ worth of security reports during 2026. The company called GitHub’s CVE-processing backlog the main factor behind the delayed formal announcement. Separately, BleepingComputer reported that Nextcloud said it wanted administrators to have time to update and had not observed widespread exploitation. These are the companies’ separate explanations.
The reported fix preceded the formal advisory
BleepingComputer reported that Collabora committed a fix on September 9 and that version 26.4.303 was released on September 11. The earliest attack date cited in its reporting was September 10, based on administrator reports. Collabora published its formal advisory on October 14 and its explanation of the disclosure delay on October 15.
| Date | Event |
| September 9, 2026 | BleepingComputer reported that Collabora committed the fix. |
| September 10, 2026 | Earliest administrator-reported attack date cited by BleepingComputer. |
| September 11, 2026 | BleepingComputer reported the release of richdocumentscode 26.4.303. |
| October 14, 2026 | Collabora published its security advisory. |
| October 15, 2026 | Collabora published its explanation of the disclosure delay. |
Which Nextcloud app is affected, and what should administrators do?
Collabora identifies versions of Nextcloud’s optional Collabora Online - Built-in CODE Server app, packaged as richdocumentscode, earlier than 26.4.303 as affected. The unauthenticated flaw allows an operating-system command to run with the web server user’s privileges through the app’s proxy.php endpoint—but only while the built-in CODE server is not running, including during a restart or upgrade, or after a crash. Collabora’s advisory says to update to 26.4.303 or later, or remove the app. Simply disabling it does not address the issue.
For Nextcloud 29 or earlier, Collabora advises upgrading Nextcloud or removing the app. The company says standalone Collabora Online, Docker images, RPM/DEB packages and Nextcloud All-in-One images are unaffected. Collabora also said the built-in app is used by a minority of Nextcloud users and that no Collabora Online customers were affected.
The advisory distinguishes CVE-2026-110447 from CVE-2025-66208 and says the fix for the earlier vulnerability does not prevent this one. NeoTeo covered that distinction in its earlier report.
What administrators reported
BleepingComputer reported administrator accounts of attacks against multiple endpoints, including PHP web shells and searches for password databases, password-manager artifacts and cryptocurrency wallets. The earliest reported activity was September 10, 2026. These accounts describe reported activity; they do not establish how many servers were affected.
