CVE-2025-66513CWE-639

CVE-2025-66513

Medium · published December 5, 2025

CVSS v3.1
4.3
EPSS
0%
Percentile
21.0
In the wild
Unconfirmed
What it is

Nextcloud Tables allows you to create your own tables with individual columns. Prior to 0.8.9, 0.9.6, and 1.0.1, the information which table (numeric ID) is shared with which groups or users and the respective permissions was not limited to privileged users. This vulnerability is fixed in 0.8.9, 0.9.6, and 1.0.1.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00295 · 21.0th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2025-12-05T23:15Z
Affected products (3)
ProductVersionsFixed in
nextcloud/tables≥ 0.6.0, < 0.8.90.8.9
nextcloud/tables≥ 0.9.0, < 0.9.60.9.6
nextcloud/tables≥ 1.0.0, < 1.0.11.0.1
References (4)
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-2cwj-qp49-4xfw · [email protected]https://github.com/nextcloud/tables/commit/b92b9560b1e70a02b103a7aeb9e22e2ab5231873 · [email protected]https://github.com/nextcloud/tables/pull/2148 · [email protected]https://hackerone.com/reports/3334165 · [email protected]
EPSS history
Timeline
  • 05 DEC 17:11Z
    Nextcloud Tables app share information not limited to relevant users
    cvelistv5