PT-2025-49299 · Nextcloud · Nextcloud Deck

Published 2025-12-05 · Updated 2025-12-09 · CVE-2025-66557

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions Nextcloud Deck versions prior to 1.14.6 Nextcloud Deck versions prior to 1.15.2

Description Nextcloud Deck is a kanban style organization tool for personal and team project management integrated with Nextcloud. A flaw in the permission logic permitted users possessing “Can share” permission to alter the permissions assigned to other recipients.

Recommendations Update to Nextcloud Deck version 1.14.6 or later. Update to Nextcloud Deck version 1.15.2 or later.

Exploit

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2025-66557

GHSA-WWR8-HX9G-RJVV

Affected Products

Nextcloud Deck

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66557.json · Exploit
• https://github.com/nextcloud/deck/pull/7131 · Patch
• https://github.com/nextcloud/deck/commit/f1da8b30a455f02373d44154da04494c949a95ae · Patch
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-wwr8-hx9g-rjvv · Vendor Advisory
• https://hackerone.com/reports/3247499 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-66557 · Security Note
• https://osv.dev/vulnerability/CVE-2025-66557 · Vendor Advisory
• https://twitter.com/CVEnew/status/1997000966613135488 · Twitter Post
• https://t.me/cveNotify/145228 · Telegram Post
• https://twitter.com/dailycve/status/1998484460644479256 · Twitter Post
• https://t.me/CVEtracker/38953 · Telegram Post