CVE-2026-45285

@@ -43,6 +43,9 @@ Those groups of people can then be used by any other app for sharing purpose.
 			<step>OCA\Circles\Migration\Migration</step>
 			<step>OCA\Circles\Migration\SyncGroupCircles</step>
 		</post-migration>
+		<live-migration>
+			<step>OCA\Circles\Migration\RemoveShareTokens</step>
+		</live-migration>
 	</repair-steps>
 
 	<commands>

@@ -23,6 +23,7 @@ class ConfigLexicon implements ILexicon {
 	public const USER_SINGLE_ID = 'userSingleId';
 	public const FEDERATED_TEAMS_ENABLED = 'federated_teams_enabled';
 	public const FEDERATED_TEAMS_FRONTAL = 'federated_teams_frontal';
+	public const REMOVE_SHARE_TOKENS_DONE = 'remove_share_tokens_done';
 
 	public function getStrictness(): Strictness {
 		return Strictness::IGNORE;
@@ -32,6 +33,7 @@ public function getAppConfigs(): array {
 		return [
 			new Entry(key: self::FEDERATED_TEAMS_ENABLED, type: ValueType::BOOL, defaultRaw: false, definition: 'disable/enable Federated Teams', lazy: true),
 			new Entry(key: self::FEDERATED_TEAMS_FRONTAL, type: ValueType::STRING, defaultRaw: '', definition: 'domain name used to auth public request', lazy: true),
+			new Entry(key: self::REMOVE_SHARE_TOKENS_DONE, type: ValueType::BOOL, defaultRaw: false, definition: 'whether the remove share tokens repair step has already been executed', lazy: true),
 		];
 	}
 

@@ -0,0 +1,58 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Circles\Migration;
+
+use OCA\Circles\ConfigLexicon;
+use OCP\AppFramework\Services\IAppConfig;
+use OCP\DB\QueryBuilder\IQueryBuilder;
+use OCP\IDBConnection;
+use OCP\Migration\IOutput;
+use OCP\Migration\IRepairStep;
+use OCP\Share\IShare;
+
+/**
+ * Class RemoveShareTokens
+ *
+ * @package OCA\Circles\Migration
+ */
+class RemoveShareTokens implements IRepairStep {
+
+	public function __construct(
+		private IDBConnection $dbConnection,
+		private readonly IAppConfig $appConfig,
+	) {
+	}
+
+	public function getName(): string {
+		return 'Remove token from shares related to circles';
+	}
+
+	public function run(IOutput $output): void {
+		if ($this->appConfig->getAppValueBool(ConfigLexicon::REMOVE_SHARE_TOKENS_DONE)) {
+			return;
+		}
+
+		$qb = $this->dbConnection->getQueryBuilder();
+		$qb->update('share')
+			->set('token', $qb->createNamedParameter(null, IQueryBuilder::PARAM_NULL))
+			->where($qb->expr()->eq('share_type', $qb->createNamedParameter(IShare::TYPE_CIRCLE, IQueryBuilder::PARAM_INT)))
+			->andWhere($qb->expr()->isNotNull('token'))
+			->setMaxResults(1000);
+
+		while (true) {
+			$updated = $qb->executeStatement();
+			if ($updated === 0) {
+				break;
+			}
+		}
+
+		$this->appConfig->setAppValueBool(ConfigLexicon::REMOVE_SHARE_TOKENS_DONE, true);
+	}
+}

@@ -154,7 +154,7 @@ public function setToken(string $token): self {
 	}
 
 	public function getToken(): string {
-		return $this->token;
+		return $this->shareToken?->getToken() ?? '';
 	}
 
 	public function setStatus(int $status): self {

@@ -142,7 +142,6 @@ public function create(IShare $share): IShare {
 			->add(DataProbe::INITIATOR, [DataProbe::BASED_ON]);
 
 		$circle = $this->circleService->probeCircle($share->getSharedWith(), $circleProbe, $dataProbe);
-		$share->setToken($this->token(15));
 		$share->setMailSend(true);
 		$owner = $circle->getInitiator();
 		$this->shareWrapperService->save($share);