Nextcloud GmbH fixes misconfigured Elasticsearch database after potential data leak (heise.de)

• Misconfigured Elasticsearch cluster with over 360,000 records exposed.
• Discovered on May 18, 2026 by Cybernews researchers; Nextcloud closed gap two days after notification.
• Nextcloud software and users unaffected; no known data misuse.

"A misconfigured Elasticsearch database at Nextcloud GmbH exposed over 360,000 records, including customer, partner, and employee data. Security researchers discovered the leak on May 18, 2026, and notified the company a week later. Nextcloud closed the vulnerability within two days and informed regulators. The open-source collaboration software itself was unaffected. No data misuse has been confirmed."