PT-2025-49288 · Nextcloud · Nextcloud Tables

Published 2025-12-05 · Updated 2025-12-09 · CVE-2025-66513

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Nextcloud Tables versions prior to 0.8.9 Nextcloud Tables versions prior to 0.9.6 Nextcloud Tables versions prior to 1.0.1

Description Nextcloud Tables allows users to create custom tables with defined columns. Before versions 0.8.9, 0.9.6, and 1.0.1, restrictions were lacking regarding which users and groups could access information about shared tables and their associated permissions. This allowed unauthorized access to table sharing and permission details.

Recommendations Update Nextcloud Tables to version 0.8.9 or later. Update Nextcloud Tables to version 0.9.6 or later. Update Nextcloud Tables to version 1.0.1 or later.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2025-66513

GHSA-2CWJ-QP49-4XFW

Affected Products

Nextcloud Tables

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66513.json · Exploit
• https://github.com/nextcloud/tables/commit/b92b9560b1e70a02b103a7aeb9e22e2ab5231873 · Patch
• https://github.com/nextcloud/tables/pull/2148 · Patch
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-2cwj-qp49-4xfw · Vendor Advisory
• https://hackerone.com/reports/3334165 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-66513 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-66513 · Security Note
• https://twitter.com/CVEnew/status/1996997029260939382 · Twitter Post
• https://t.me/cveNotify/145260 · Telegram Post
• https://t.me/CVEtracker/38943 · Telegram Post