CVE-2025-66557CWE-284broken-access-control

CVE-2025-66557

Medium · published December 5, 2025

CVSS v3.1
5.4
EPSS
0%
Percentile
19.3
In the wild
Unconfirmed
What it is

Nextcloud Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. Prior to 1.14.6 and 1.15.2, a bug in the permission logic allowed users with "Can share" permission to modify the permissions of other recipients. This vulnerability is fixed in 1.14.6 and 1.15.2.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00279 · 19.3th percentile
Weakness
CWE-284 · Improper Access Control
Published
2025-12-05T23:15Z
Affected products (2)
ProductVersionsFixed in
nextcloud/deck≥ 1.14.0, < 1.14.61.14.6
nextcloud/deck≥ 1.15.0, < 1.15.21.15.2
References (4)
https://github.com/nextcloud/deck/commit/f1da8b30a455f02373d44154da04494c949a95ae · [email protected]https://github.com/nextcloud/deck/pull/7131 · [email protected]https://github.com/nextcloud/security-advisories/security/advisories/GHSA-wwr8-hx9g-rjvv · [email protected]https://hackerone.com/reports/3247499 · [email protected]
EPSS history
Timeline
  • 05 DEC 17:28Z
    Nextcloud Deck app allowed user with "Can share" permission to modify permissions of other non-owners
    cvelistv5