PT-2025-49265 · Nextcloud+1 · Nextcloud Server+2

Published 2025-12-05 · Updated 2026-01-29 · CVE-2025-66510

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Nextcloud Server versions prior to 31.0.10 Nextcloud Server version 32.0.1 Nextcloud Enterprise Server versions prior to 28.0.14.11 Nextcloud Enterprise Server versions prior to 29.0.16.8 Nextcloud Enterprise Server versions prior to 30.0.17.3 Nextcloud Enterprise Server versions prior to 31.0.10

Description Nextcloud Server and Nextcloud Enterprise Server contain a flaw where the contacts search function does not enforce proper access controls. This allows an authenticated user to access personal data, such as emails, names, and identifiers, belonging to other users without authorization. The affected data pertains to accounts that have not been added as contacts by the user.

Recommendations Update Nextcloud Server to version 31.0.10 or later. Update Nextcloud Server to version 32.0.1 or later. Update Nextcloud Enterprise Server to version 28.0.14.11 or later. Update Nextcloud Enterprise Server to version 29.0.16.8 or later. Update Nextcloud Enterprise Server to version 30.0.17.3 or later. Update Nextcloud Enterprise Server to version 31.0.10 or later.

Exploit

Fix

Weakness Enumeration

CWE-359

Related Identifiers

BDU:2026-03384

CVE-2025-66510

GHSA-495W-CQV6-WR59

Affected Products

Nextcloud Enterprise Server

Nextcloud Server

Red Os

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66510.json · Exploit
• https://github.com/nextcloud/server/commit/e4866860cbf24a746eb8a125587262a4c8831c57 · Patch
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-495w-cqv6-wr59 · Vendor Advisory
• http://repo.red-soft.ru/redos/8.0/x86_64/updates · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-66510 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-66510 · Security Note
• https://bdu.fstec.ru/vul/2026-03384 · Security Note
• https://github.com/nextcloud/server/pull/55657 · Note
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti-red-os-8-0/uyazvimost-nextcloud-cve-2025-66510-8.0 · Note
• https://twitter.com/CVEnew/status/1996985623710679299 · Twitter Post
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/uyazvimost-nextcloud-cve-2025-66510-7.3 · Note
• https://twitter.com/VulmonFeeds/status/1997015134175117445 · Twitter Post