PT-2025-49266 · Nextcloud+1 · Nextcloud Calendar+1

Published 2025-12-05 · Updated 2026-01-29 · CVE-2025-66511

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Nextcloud Calendar versions prior to 6.0.3

Description The Calendar application for Nextcloud generates participant tokens for meeting proposals using a predictable hash function. This allows an attacker to compute valid tokens, potentially enabling them to request details and submit dates for meeting proposals. The tokens are not randomly generated.

Recommendations Update to version 6.0.3 or later.

Exploit

Fix

Use of Insufficiently Random Values

Weakness Enumeration

CWE-330

Related Identifiers

BDU:2026-03383

CVE-2025-66511

GHSA-WHM3-VV55-GF27

Affected Products

Nextcloud Calendar

Red Os

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66511.json · Exploit
• https://github.com/nextcloud/calendar/commit/8de14ae87f321f5f09280d9895a27d54d24f33fb · Patch
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-whm3-vv55-gf27 · Vendor Advisory
• http://repo.red-soft.ru/redos/8.0/x86_64/updates · Vendor Advisory
• https://hackerone.com/reports/3385434 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-03383 · Security Note
• https://osv.dev/vulnerability/CVE-2025-66511 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-66511 · Security Note
• https://github.com/nextcloud/calendar/pull/7659 · Note
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/uyazvimost-nextcloud-app-calendar-cve-2025-66511-7.3 · Note
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti-red-os-8-0/uyazvimost-nextcloud-app-calendar-cve-2025-66511-8.0 · Note
• https://twitter.com/VulmonFeeds/status/1997020253121905090 · Twitter Post
• https://twitter.com/CVEnew/status/1996985615179452456 · Twitter Post