PT-2025-49291 · Nextcloud · Nextcloud Tables

Published 2025-12-05 · Updated 2025-12-09 · CVE-2025-66551

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:L

Name of the Vulnerable Software and Affected Versions Nextcloud Tables versions prior to 0.8.6 Nextcloud Tables versions prior to 0.9.3

Description A malicious user could create a table and move a column into another user's table. This action was possible in versions before 0.8.6 and 0.9.3.

Recommendations Update to Nextcloud Tables version 0.8.6 or later. Update to Nextcloud Tables version 0.9.3 or later.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2025-66551

GHSA-W787-VWQP-8WR7

Affected Products

Nextcloud Tables

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66551.json · Exploit
• https://github.com/nextcloud/tables/commit/39f24a62fb41fd7a8bda65325f8bbafdc91c731c · Patch
• https://github.com/nextcloud/tables/pull/1810 · Patch
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-w787-vwqp-8wr7 · Vendor Advisory
• https://hackerone.com/reports/3137895 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-66551 · Security Note
• https://osv.dev/vulnerability/CVE-2025-66551 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1997127759089320175 · Twitter Post
• https://twitter.com/dailycve/status/1998485912561590352 · Twitter Post
• https://twitter.com/CVEnew/status/1997000984988357092 · Twitter Post
• https://t.me/CVEtracker/38949 · Telegram Post