CVE-2025-66551

Katalog CVE

CVSS 4.3 · Medium EPSS 0,25%

Kerentanan Authorization Bypass Through User-Controlled Key pada nextcloud tables. Skor CVSS 3.1 4.3 (Medium) menurut NVD.

Deskripsi (NVD)

Nextcloud Tables allows you to create your own tables with individual columns. Prior to 0.8.6 and 0.9.3, a malicious user was able to create their own table and then move a column to a victims table. This vulnerability is fixed in 0.8.6 and 0.9.3.

Rincian

Terbit di NVD

5 Desember 2025

Terakhir diubah

25 September 2026

Status NVD

Analyzed

CVSS 3.1

4.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-639: Authorization Bypass Through User-Controlled Key

EPSS (30 hari)

0,25% peluang dieksploitasi; lebih tinggi dari 15,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-w787-vwqp-8wr7 advisory vendor
• https://hackerone.com/reports/3137895 issue tracking · advisory vendor
• https://github.com/nextcloud/tables/commit/39f24a62fb41fd7a8bda65325f8bbafdc91c731c patch
• https://github.com/nextcloud/tables/pull/1810 issue tracking · patch