CVE-2025-66546CWE-639

CVE-2025-66546

Low · published December 5, 2025

CVSS v3.1
3.3
EPSS
0%
Percentile
2.9
In the wild
Unconfirmed
What it is

Nextcloud Calendar is a calendar app for Nextcloud. Prior to 4.7.19, 5.5.6, and 6.0.1, the calendar app allowed blindly booking appointments with a squential ID without known the appointment token. This vulnerability is fixed in 4.7.19, 5.5.6, and 6.0.1.

The record
Technical detail
CVSS v3.1
3.3 · LOW
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00139 · 2.9th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2025-12-05T22:16Z
Affected products (9)
ProductVersionsFixed in
nextcloud/calendar≥ 4.0.0, < 4.7.194.7.19
nextcloud/calendar≥ 5.0.0, < 5.5.65.5.6
nextcloud/calendarall versions—
nextcloud/calendarall versions—
nextcloud/calendarall versions—
nextcloud/calendarall versions—
nextcloud/calendarall versions—
nextcloud/calendarall versions—
nextcloud/calendarall versions—
References (4)
https://github.com/nextcloud/calendar/commit/f41650c3681fc4a4130eb883f5c0899c011326b3 · [email protected]https://github.com/nextcloud/calendar/pull/7537 · [email protected]https://github.com/nextcloud/security-advisories/security/advisories/GHSA-7x2j-2674-fj95 · [email protected]https://hackerone.com/reports/3275810 · [email protected]
EPSS history
Timeline
  • 05 DEC 16:49Z
    Nextcloud Calendar app allowed booking appointments without the generated token
    cvelistv5