PT-2025-49292 · Nextcloud · Nextcloud Tables

Published 2025-12-05 · Updated 2025-12-06 · CVE-2025-66553

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Nextcloud Tables versions prior to 0.8.7 Nextcloud Tables versions prior to 0.9.4

Description Authenticated users could view metadata of columns in other tables within the Tables app by manipulating the numeric ID in a request. This allowed unauthorized access to information about table structures.

Recommendations Update to Nextcloud Tables version 0.8.7 or later. Update to Nextcloud Tables version 0.9.4 or later.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2025-66553

GHSA-P53H-6294-CRJW

Affected Products

Nextcloud Tables

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66553.json · Exploit
• https://github.com/nextcloud/tables/commit/e975f5bfedb6922f04cdd236cde4e26067fe064e · Patch
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-p53h-6294-crjw · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-66553 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-66553 · Security Note
• https://hackerone.com/reports/3138721 · Vendor Advisory
• https://github.com/nextcloud/tables/pull/1891 · Note
• https://twitter.com/VulmonFeeds/status/1997122639173742621 · Twitter Post
• https://t.me/CVEtracker/38950 · Telegram Post
• https://twitter.com/CVEnew/status/1997000972447502363 · Twitter Post