CVE-2025-66551

6.3 MEDIUM

Published: December 05, 2025 Modified: December 09, 2025

Description

Nextcloud Tables allows you to create your own tables with individual columns. Prior to 0.8.6 and 0.9.3, a malicious user was able to create their own table and then move a column to a victims table. This vulnerability is fixed in 0.8.6 and 0.9.3.

AI Explanation

Get an AI-powered plain-language explanation of this vulnerability and remediation steps.

CVSS v3.x Details

0.0 Low Medium High Critical 10.0

Vector String

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:L

References to Advisories, Solutions, and Tools

Patch Vendor Advisory Exploit Third Party Advisory

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-w787-vwqp-8wr7

Source: security-advisories@github.com

Vendor Advisory

https://github.com/nextcloud/tables/commit/39f24a62fb41fd7a8bda65325f8bbafdc91c731c

Source: security-advisories@github.com

Patch

https://github.com/nextcloud/tables/pull/1810

Source: security-advisories@github.com

Issue Tracking Patch

https://hackerone.com/reports/3137895

Source: security-advisories@github.com

Issue Tracking Vendor Advisory

4 reference(s) from NVD

Quick Stats

CVSS v3 Score

6.3 / 10.0

EPSS (Exploit Probability)

0.0%

1th percentile

Exploitation Status

Not in CISA KEV

Weaknesses (CWE)

CWE-639

Affected Vendors

nextcloud

Related CVEs