CVE-2025-66553CWE-639

CVE-2025-66553

Medium · published December 5, 2025

CVSS v3.1
4.3
EPSS
0%
Percentile
19.1
In the wild
Unconfirmed
What it is

Nextcloud Tables allows you to create your own tables with individual columns. Prior to 0.8.7 and 0.9.4, authenticated users were able to view meta data of columns in other tables of the Tables app by modifying the numeric ID in a request. This vulnerability is fixed in 0.8.7 and 0.9.4.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00276 · 19.1th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2025-12-05T23:15Z
Affected products (2)
ProductVersionsFixed in
nextcloud/tables≥ 0.8.0, < 0.8.70.8.7
nextcloud/tables≥ 0.9.0, < 0.9.40.9.4
References (4)
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-p53h-6294-crjw · [email protected]https://github.com/nextcloud/tables/commit/e975f5bfedb6922f04cdd236cde4e26067fe064e · [email protected]https://github.com/nextcloud/tables/pull/1891 · [email protected]https://hackerone.com/reports/3138721 · [email protected]
EPSS history
Timeline
  • 05 DEC 17:18Z
    Nextcloud Tables app allowed users to view columns metadata information of any table
    cvelistv5