CVE-2025-66510CWE-359

CVE-2025-66510

Medium · published December 5, 2025

CVSS v3.1
4.5
EPSS
0%
Percentile
28.3
In the wild
Unconfirmed
What it is

Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server prior to 31.0.10 and 32.0.1 and Nextcloud Enterprise Server prior to 28.0.14.11, 29.0.16.8, 30.0.17.3, and 31.0.10, contacts search allowed to retrieve personal data of other users (emails, names, identifiers) without proper access control. This allows an authenticated user to retrieve information about accounts that are not related or added as contacts.

The record
Technical detail
CVSS v3.1
4.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00358 · 28.3th percentile
Weakness
CWE-359 · Exposure of Private Personal Information to an Unauthorized Actor
Published
2025-12-05T22:16Z
Affected products (6)
ProductVersionsFixed in
nextcloud/nextcloud_server≥ 28.0.0, < 28.0.14.1128.0.14.11
nextcloud/nextcloud_server≥ 29.0.0, < 29.0.16.829.0.16.8
nextcloud/nextcloud_server≥ 30.0.0, < 30.0.17.330.0.17.3
nextcloud/nextcloud_server≥ 31.0.0, < 31.0.1031.0.10
nextcloud/nextcloud_server≥ 31.0.0, < 31.0.1031.0.10
nextcloud/nextcloud_server≥ 32.0.0, < 32.0.132.0.1
References (3)
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-495w-cqv6-wr59 · [email protected]https://github.com/nextcloud/server/commit/e4866860cbf24a746eb8a125587262a4c8831c57 · [email protected]https://github.com/nextcloud/server/pull/55657 · [email protected]
EPSS history
Timeline
  • 05 DEC 16:18Z
    Nextcloud Server Contacts Search allowed users to retrieve contact information of other users beyond their contact list
    cvelistv5