Vulnerability-Lookup

CVE-2025-66546 (GCVE-0-2025-66546)

Vulnerability from cvelistv5 – Published: 2025-12-05 16:49 – Updated: 2025-12-05 18:32

Title

Nextcloud Calendar app allowed booking appointments without the generated token

Summary

Nextcloud Calendar is a calendar app for Nextcloud. Prior to 4.7.19, 5.5.6, and 6.0.1, the calendar app allowed blindly booking appointments with a squential ID without known the appointment token. This vulnerability is fixed in 4.7.19, 5.5.6, and 6.0.1.

Severity

3.3 (Low)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-12-05 18:32 UTC

CWE

CWE-639 - Authorization Bypass Through User-Controlled Key

Assigner

GitHub_M mitre root Scorecard

References

4 references

URL	Tags
https://github.com/nextcloud/security-advisories/…	x_refsource_CONFIRM
https://github.com/nextcloud/calendar/pull/7537	x_refsource_MISC
https://github.com/nextcloud/calendar/commit/f416…	x_refsource_MISC
https://hackerone.com/reports/3275810	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
nextcloud	security-advisories	Affected: >= 6.0.0-rc.1, < 6.0.1 Affected: >= 5.0.0-rc.1, < 5.5.6 Affected: >= 3.0.0-beta1, < 4.7.19

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-66546",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-05T18:32:11.684776Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-12-05T18:32:44.271Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "security-advisories",
          "vendor": "nextcloud",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 6.0.0-rc.1, \u003c 6.0.1"
            },
            {
              "status": "affected",
              "version": "\u003e= 5.0.0-rc.1, \u003c 5.5.6"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.0.0-beta1, \u003c 4.7.19"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Nextcloud Calendar is a calendar app for Nextcloud. Prior to 4.7.19, 5.5.6, and 6.0.1, the calendar app allowed blindly booking appointments with a squential ID without known the appointment token. This vulnerability is fixed in 4.7.19, 5.5.6, and 6.0.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639: Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-12-05T16:49:46.553Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-7x2j-2674-fj95",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-7x2j-2674-fj95"
        },
        {
          "name": "https://github.com/nextcloud/calendar/pull/7537",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nextcloud/calendar/pull/7537"
        },
        {
          "name": "https://github.com/nextcloud/calendar/commit/f41650c3681fc4a4130eb883f5c0899c011326b3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nextcloud/calendar/commit/f41650c3681fc4a4130eb883f5c0899c011326b3"
        },
        {
          "name": "https://hackerone.com/reports/3275810",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://hackerone.com/reports/3275810"
        }
      ],
      "source": {
        "advisory": "GHSA-7x2j-2674-fj95",
        "discovery": "UNKNOWN"
      },
      "title": "Nextcloud Calendar app allowed booking appointments without the generated token"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-66546",
    "datePublished": "2025-12-05T16:49:46.553Z",
    "dateReserved": "2025-12-04T15:52:26.549Z",
    "dateUpdated": "2025-12-05T18:32:44.271Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-66546",
      "date": "2026-10-01",
      "epss": "0.00139",
      "percentile": "0.02694"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "security-advisories",
                "vendor": "nextcloud",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003e= 6.0.0-rc.1, \u003c 6.0.1"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 5.0.0-rc.1, \u003c 5.5.6"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 3.0.0-beta1, \u003c 4.7.19"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:nextcloud:calendar:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "84E1FFC4-516D-4680-9F67-E66C1FAE5E0B",
                    "versionEndExcluding": "4.7.19",
                    "versionStartIncluding": "4.0.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:nextcloud:calendar:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "3E716F13-981B-49BA-98FF-3B52C9962EA2",
                    "versionEndExcluding": "5.5.6",
                    "versionStartIncluding": "5.0.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:nextcloud:calendar:6.0.0:-:*:*:*:*:*:*",
                    "matchCriteriaId": "5FEEB806-FB4C-42B4-BE4E-297AB95A854F",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:nextcloud:calendar:6.0.0:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "B1A878DF-8A9B-4987-8E2C-6873CA2C8427",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:nextcloud:calendar:6.0.0:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "9B9884CA-4E88-4AB3-BA37-FAF9E845F04E",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:nextcloud:calendar:6.0.0:rc3:*:*:*:*:*:*",
                    "matchCriteriaId": "032400B7-AE78-467F-81CC-83164AC29796",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:nextcloud:calendar:6.0.0:rc4:*:*:*:*:*:*",
                    "matchCriteriaId": "D1A265F6-884F-44FF-B00F-CB5F7E704E0E",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:nextcloud:calendar:6.0.0:rc5:*:*:*:*:*:*",
                    "matchCriteriaId": "8249ACE0-0485-4485-B628-D157E57A91C0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:nextcloud:calendar:6.0.0:rc6:*:*:*:*:*:*",
                    "matchCriteriaId": "508556C9-5596-42B5-AD76-8156A42FEED7",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Nextcloud Calendar is a calendar app for Nextcloud. Prior to 4.7.19, 5.5.6, and 6.0.1, the calendar app allowed blindly booking appointments with a squential ID without known the appointment token. This vulnerability is fixed in 4.7.19, 5.5.6, and 6.0.1."
          }
        ],
        "id": "CVE-2025-66546",
        "lastModified": "2026-06-17T09:57:00.350",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "NONE",
                "baseScore": 3.3,
                "baseSeverity": "LOW",
                "confidentialityImpact": "LOW",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 1.4,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2025-66546",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-05T18:32:11.684776Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2025-12-05T17:16:05.163",
        "references": [
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Patch"
            ],
            "url": "https://github.com/nextcloud/calendar/commit/f41650c3681fc4a4130eb883f5c0899c011326b3"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Issue Tracking"
            ],
            "url": "https://github.com/nextcloud/calendar/pull/7537"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Patch",
              "Vendor Advisory"
            ],
            "url": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-7x2j-2674-fj95"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Issue Tracking",
              "Vendor Advisory"
            ],
            "url": "https://hackerone.com/reports/3275810"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-639"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2025-66546",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2025-12-05T18:32:11.684776Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2025-12-05T18:32:34.528Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "security-advisories",
              "vendor": "nextcloud",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003e= 6.0.0-rc.1, \u003c 6.0.1"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 5.0.0-rc.1, \u003c 5.5.6"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 3.0.0-beta1, \u003c 4.7.19"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Nextcloud Calendar is a calendar app for Nextcloud. Prior to 4.7.19, 5.5.6, and 6.0.1, the calendar app allowed blindly booking appointments with a squential ID without known the appointment token. This vulnerability is fixed in 4.7.19, 5.5.6, and 6.0.1."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "NONE",
                "baseScore": 3.3,
                "baseSeverity": "LOW",
                "confidentialityImpact": "LOW",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-639",
                  "description": "CWE-639: Authorization Bypass Through User-Controlled Key",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2025-12-05T16:49:46.553Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-7x2j-2674-fj95",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-7x2j-2674-fj95"
            },
            {
              "name": "https://github.com/nextcloud/calendar/pull/7537",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/nextcloud/calendar/pull/7537"
            },
            {
              "name": "https://github.com/nextcloud/calendar/commit/f41650c3681fc4a4130eb883f5c0899c011326b3",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/nextcloud/calendar/commit/f41650c3681fc4a4130eb883f5c0899c011326b3"
            },
            {
              "name": "https://hackerone.com/reports/3275810",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://hackerone.com/reports/3275810"
            }
          ],
          "source": {
            "advisory": "GHSA-7x2j-2674-fj95",
            "discovery": "UNKNOWN"
          },
          "title": "Nextcloud Calendar app allowed booking appointments without the generated token"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2025-66546",
        "datePublished": "2025-12-05T16:49:46.553Z",
        "dateReserved": "2025-12-04T15:52:26.549Z",
        "dateUpdated": "2025-12-05T18:32:44.271Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

BDU:2026-03580 (CVE-2025-66546)

Vulnerability from fstec – Published: 2026-03-25 – Updated: 2026-03-25 – View on bdu.fstec.ru Fixed

Title

Уязвимость приложения Nextcloud calendar облачного программного обеспечения для создания и использования хранилища данных Nextcloud, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации

Summary

Уязвимость приложения Nextcloud calendar облачного программного обеспечения для создания и использования хранилища данных Nextcloud связана с обходом авторизации посредством использования ключа, контролируемого пользователем. Эксплуатация уязвимости может позволить нарушителю получить несанкционированный доступ к защищаемой информации

Severity

1.7 (Low) CVSS 2.0


                      
                        AV:L/AC:L/Au:S/C:P/I:N/A:N

3.3 (Low) CVSS 3.1


                      
                        CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Class

Architecture vulnerability

Status

Confirmed by the vendor

Exploitation

Authorization bypass

Incidents

Being clarified

Remediation

Software update

CWE

CWE-639 - Обход авторизации посредством использования ключа, контролируемого пользователем

Aliases

CVE-2025-66546

References

6 references

URL
https://github.com/nextcloud/calendar/commit/f41650c3681fc4a4130eb883f5c0899c011326b3
https://github.com/nextcloud/calendar/pull/7537
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-7x2j-…
https://hackerone.com/reports/3275810
https://nvd.nist.gov/vuln/detail/CVE-2025-66546
https://redos.red-soft.ru/support/secure/uyazvimosti/uyazvimost-nextcloud-app-c…

Impacted products

2 products from 2 vendors

Vendors

ООО «Ред Софт», Nextcloud GmbH

Products

РЕД ОС (запись в едином реестре российских программ №3751), Nextcloud Calendar

Versions

8.0 (РЕД ОС), до 6.1.2 (Nextcloud Calendar)

Product types

Operating system, Application software

Platforms

ООО «Ред Софт» РЕД ОС 8.0 (запись в едином реестре российских программ №3751)

Mitigations

Использование рекомендаций: https://github.com/nextcloud/security-advisories/security/advisories/GHSA-7x2j-2674-fj95 Для Ред ОС: https://redos.red-soft.ru/support/secure/uyazvimosti/uyazvimost-nextcloud-app-calendar-cve-2025-66546-7.3/?sphrase_id=1456287

JSON

To clipboard

{
  "CVSS 2.0": "AV:L/AC:L/Au:S/C:P/I:N/A:N",
  "CVSS 3.0": "AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
  "CVSS 4.0": null,
  "remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
  "remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
  "\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "\u041e\u041e\u041e \u00ab\u0420\u0435\u0434 \u0421\u043e\u0444\u0442\u00bb, Nextcloud GmbH",
  "\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "8.0 (\u0420\u0415\u0414 \u041e\u0421), \u0434\u043e 6.1.2 (Nextcloud Calendar)",
  "\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439:\nhttps://github.com/nextcloud/security-advisories/security/advisories/GHSA-7x2j-2674-fj95\n\n\n\u0414\u043b\u044f \u0420\u0435\u0434 \u041e\u0421:\nhttps://redos.red-soft.ru/support/secure/uyazvimosti/uyazvimost-nextcloud-app-calendar-cve-2025-66546-7.3/?sphrase_id=1456287",
  "\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "05.12.2025",
  "\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "25.03.2026",
  "\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "25.03.2026",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2026-03580",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2025-66546",
  "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
  "\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u044b",
  "\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "\u0420\u0415\u0414 \u041e\u0421 (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u21163751), Nextcloud Calendar",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": "\u041e\u041e\u041e \u00ab\u0420\u0435\u0434 \u0421\u043e\u0444\u0442\u00bb \u0420\u0415\u0414 \u041e\u0421 8.0  (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u21163751)",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f Nextcloud calendar \u043e\u0431\u043b\u0430\u0447\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f \u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u0445\u0440\u0430\u043d\u0438\u043b\u0438\u0449\u0430 \u0434\u0430\u043d\u043d\u044b\u0445 Nextcloud, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043d\u0435\u0441\u0430\u043d\u043a\u0446\u0438\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0437\u0430\u0449\u0438\u0449\u0430\u0435\u043c\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438",
  "\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u041e\u0431\u0445\u043e\u0434 \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u0438 \u043f\u043e\u0441\u0440\u0435\u0434\u0441\u0442\u0432\u043e\u043c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u043a\u043b\u044e\u0447\u0430, \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u0443\u0435\u043c\u043e\u0433\u043e \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c (CWE-639)",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f Nextcloud calendar \u043e\u0431\u043b\u0430\u0447\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f \u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u0445\u0440\u0430\u043d\u0438\u043b\u0438\u0449\u0430 \u0434\u0430\u043d\u043d\u044b\u0445 Nextcloud \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043e\u0431\u0445\u043e\u0434\u043e\u043c \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u0438 \u043f\u043e\u0441\u0440\u0435\u0434\u0441\u0442\u0432\u043e\u043c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u043a\u043b\u044e\u0447\u0430, \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u0443\u0435\u043c\u043e\u0433\u043e \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043d\u0435\u0441\u0430\u043d\u043a\u0446\u0438\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0437\u0430\u0449\u0438\u0449\u0430\u0435\u043c\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438",
  "\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
  "\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": null,
  "\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u041d\u0430\u0440\u0443\u0448\u0435\u043d\u0438\u0435 \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u0438",
  "\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "https://github.com/nextcloud/calendar/commit/f41650c3681fc4a4130eb883f5c0899c011326b3\nhttps://github.com/nextcloud/calendar/pull/7537\nhttps://github.com/nextcloud/security-advisories/security/advisories/GHSA-7x2j-2674-fj95\nhttps://hackerone.com/reports/3275810\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-66546\nhttps://redos.red-soft.ru/support/secure/uyazvimosti/uyazvimost-nextcloud-app-calendar-cve-2025-66546-7.3/?sphrase_id=1456287",
  "\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
  "\u0422\u0438\u043f \u041f\u041e": "\u041e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u0430\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u0430, \u041f\u0440\u0438\u043a\u043b\u0430\u0434\u043d\u043e\u0435 \u041f\u041e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c",
  "\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-639",
  "\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041d\u0438\u0437\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 1,7)\n\u041d\u0438\u0437\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 3.1 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 3,3)"
}

CERTFR-2025-AVI-1066

Vulnerability from certfr_avis - Published: 2025-12-05 - Updated: 2025-12-05

De multiples vulnérabilités ont été découvertes dans les produits Nextcloud. Certaines d'entre elles permettent à un attaquant de provoquer une atteinte à la confidentialité des données, une atteinte à l'intégrité des données et une injection de code indirecte à distance (XSS).

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

Vendor	Product	Description
Nextcloud	Server	Server versions 28.0.x antérieures à 28.0.14.11
Nextcloud	Groupfolders	Groupfolders versions 15.3.x antérieures à 15.3.12
Nextcloud	Server	Server versions 30.0.x antérieures à 30.0.17.3
Nextcloud	Server	Server versions 31.0.x antérieures à 31.0.12
Nextcloud	Calendar	Calendar versions 5.x antérieures à 5.5.6
Nextcloud	Deck	Deck versions 1.14.x antérieures à 1.14.4
Nextcloud	Groupfolders	Groupfolders versions 19.1.x antérieures à 19.1.8
Nextcloud	Server	Server versions 29.0.x antérieures à 29.0.16.8
Nextcloud	Groupfolders	Groupfolders versions 16.0.x antérieures à 16.0.15
Nextcloud	Calendar	Calendar versions 4.x antérieures à 4.7.19
Nextcloud	Approval	Approval versions 2.x antérieures à 2.5.0
Nextcloud	Groupfolders	Groupfolders versions 18.1.x antérieures à 18.1.8
Nextcloud	Deck	Deck versions 1.15.x antérieures à 1.15.1
Nextcloud	Tables	Tables versions antérieures à 1.0.1
Nextcloud	Server	Server versions 32.0.x antérieures à 32.0.3
Nextcloud	Approval	Approval versions 1.x antérieures à 1.3.1
Nextcloud	Calendar	Calendar versions 6.0.x antérieures à 6.0.3
Nextcloud	Deck	Deck versions 1.12.x antérieures à 1.12.7
Nextcloud	Groupfolders	Groupfolders versions 17.0.x antérieures à 17.0.14
Nextcloud	Mail	Mail versions antérieures à 5.5.3
Nextcloud	Groupfolders	Groupfolders versions 14.0.x antérieures à 14.0.11
Nextcloud	Groupfolders	Groupfolders versions 20.1.x antérieures à 20.1.2

References

Title

Publication Time

Tags

Bulletin de sécurité Nextcloud GHSA-q26g-fmjq-x5g5	2025-12-05	vendor-advisory
Bulletin de sécurité Nextcloud GHSA-495w-cqv6-wr59	2025-12-05	vendor-advisory
Bulletin de sécurité Nextcloud GHSA-hq6c-r898-fgf2	2025-12-05	vendor-advisory
Bulletin de sécurité Nextcloud GHSA-2vrq-fhmf-c49m	2025-12-05	vendor-advisory
Bulletin de sécurité Nextcloud GHSA-2cwj-qp49-4xfw	2025-12-05	vendor-advisory
Bulletin de sécurité Nextcloud GHSA-qcw2-p26m-9gc5	2025-12-05	vendor-advisory
Bulletin de sécurité Nextcloud GHSA-7x2j-2674-fj95	2025-12-05	vendor-advisory
Bulletin de sécurité Nextcloud GHSA-v394-8gpc-6fv5	2025-12-05	vendor-advisory
Bulletin de sécurité Nextcloud GHSA-whm3-vv55-gf27	2025-12-05	vendor-advisory
Bulletin de sécurité Nextcloud GHSA-xjvq-xvr7-xpg6	2025-12-05	vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Server versions 28.0.x ant\u00e9rieures \u00e0 28.0.14.11",
      "product": {
        "name": "Server",
        "vendor": {
          "name": "Nextcloud",
          "scada": false
        }
      }
    },
    {
      "description": "Groupfolders versions 15.3.x ant\u00e9rieures \u00e0 15.3.12",
      "product": {
        "name": "Groupfolders",
        "vendor": {
          "name": "Nextcloud",
          "scada": false
        }
      }
    },
    {
      "description": "Server versions 30.0.x ant\u00e9rieures \u00e0 30.0.17.3",
      "product": {
        "name": "Server",
        "vendor": {
          "name": "Nextcloud",
          "scada": false
        }
      }
    },
    {
      "description": "Server versions 31.0.x ant\u00e9rieures \u00e0 31.0.12",
      "product": {
        "name": "Server",
        "vendor": {
          "name": "Nextcloud",
          "scada": false
        }
      }
    },
    {
      "description": "Calendar versions 5.x ant\u00e9rieures \u00e0 5.5.6",
      "product": {
        "name": "Calendar",
        "vendor": {
          "name": "Nextcloud",
          "scada": false
        }
      }
    },
    {
      "description": "Deck versions 1.14.x ant\u00e9rieures \u00e0 1.14.4",
      "product": {
        "name": "Deck",
        "vendor": {
          "name": "Nextcloud",
          "scada": false
        }
      }
    },
    {
      "description": "Groupfolders versions 19.1.x ant\u00e9rieures \u00e0 19.1.8",
      "product": {
        "name": "Groupfolders",
        "vendor": {
          "name": "Nextcloud",
          "scada": false
        }
      }
    },
    {
      "description": "Server versions 29.0.x ant\u00e9rieures \u00e0 29.0.16.8",
      "product": {
        "name": "Server",
        "vendor": {
          "name": "Nextcloud",
          "scada": false
        }
      }
    },
    {
      "description": "Groupfolders versions 16.0.x ant\u00e9rieures \u00e0 16.0.15",
      "product": {
        "name": "Groupfolders",
        "vendor": {
          "name": "Nextcloud",
          "scada": false
        }
      }
    },
    {
      "description": "Calendar versions 4.x ant\u00e9rieures \u00e0 4.7.19",
      "product": {
        "name": "Calendar",
        "vendor": {
          "name": "Nextcloud",
          "scada": false
        }
      }
    },
    {
      "description": "Approval versions 2.x ant\u00e9rieures \u00e0 2.5.0",
      "product": {
        "name": "Approval",
        "vendor": {
          "name": "Nextcloud",
          "scada": false
        }
      }
    },
    {
      "description": "Groupfolders versions 18.1.x ant\u00e9rieures \u00e0 18.1.8",
      "product": {
        "name": "Groupfolders",
        "vendor": {
          "name": "Nextcloud",
          "scada": false
        }
      }
    },
    {
      "description": "Deck versions 1.15.x ant\u00e9rieures \u00e0 1.15.1",
      "product": {
        "name": "Deck",
        "vendor": {
          "name": "Nextcloud",
          "scada": false
        }
      }
    },
    {
      "description": "Tables versions ant\u00e9rieures \u00e0 1.0.1",
      "product": {
        "name": "Tables",
        "vendor": {
          "name": "Nextcloud",
          "scada": false
        }
      }
    },
    {
      "description": "Server versions 32.0.x ant\u00e9rieures \u00e0 32.0.3",
      "product": {
        "name": "Server",
        "vendor": {
          "name": "Nextcloud",
          "scada": false
        }
      }
    },
    {
      "description": "Approval versions 1.x ant\u00e9rieures \u00e0 1.3.1",
      "product": {
        "name": "Approval",
        "vendor": {
          "name": "Nextcloud",
          "scada": false
        }
      }
    },
    {
      "description": "Calendar versions 6.0.x ant\u00e9rieures \u00e0 6.0.3",
      "product": {
        "name": "Calendar",
        "vendor": {
          "name": "Nextcloud",
          "scada": false
        }
      }
    },
    {
      "description": "Deck versions 1.12.x ant\u00e9rieures \u00e0 1.12.7",
      "product": {
        "name": "Deck",
        "vendor": {
          "name": "Nextcloud",
          "scada": false
        }
      }
    },
    {
      "description": "Groupfolders versions 17.0.x ant\u00e9rieures \u00e0 17.0.14",
      "product": {
        "name": "Groupfolders",
        "vendor": {
          "name": "Nextcloud",
          "scada": false
        }
      }
    },
    {
      "description": "Mail versions ant\u00e9rieures \u00e0 5.5.3",
      "product": {
        "name": "Mail",
        "vendor": {
          "name": "Nextcloud",
          "scada": false
        }
      }
    },
    {
      "description": "Groupfolders versions 14.0.x ant\u00e9rieures \u00e0 14.0.11",
      "product": {
        "name": "Groupfolders",
        "vendor": {
          "name": "Nextcloud",
          "scada": false
        }
      }
    },
    {
      "description": "Groupfolders versions 20.1.x ant\u00e9rieures \u00e0 20.1.2",
      "product": {
        "name": "Groupfolders",
        "vendor": {
          "name": "Nextcloud",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2025-66511",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-66511"
    },
    {
      "name": "CVE-2025-66513",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-66513"
    },
    {
      "name": "CVE-2025-66515",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-66515"
    },
    {
      "name": "CVE-2025-66546",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-66546"
    },
    {
      "name": "CVE-2025-66512",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-66512"
    },
    {
      "name": "CVE-2025-66514",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-66514"
    },
    {
      "name": "CVE-2025-66545",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-66545"
    },
    {
      "name": "CVE-2025-66510",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-66510"
    },
    {
      "name": "CVE-2025-66547",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-66547"
    },
    {
      "name": "CVE-2025-66548",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-66548"
    }
  ],
  "initial_release_date": "2025-12-05T00:00:00",
  "last_revision_date": "2025-12-05T00:00:00",
  "links": [],
  "reference": "CERTFR-2025-AVI-1066",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2025-12-05T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Nextcloud. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es, une atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es et une injection de code indirecte \u00e0 distance (XSS).",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Nextcloud",
  "vendor_advisories": [
    {
      "published_at": "2025-12-05",
      "title": "Bulletin de s\u00e9curit\u00e9 Nextcloud GHSA-q26g-fmjq-x5g5",
      "url": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-q26g-fmjq-x5g5"
    },
    {
      "published_at": "2025-12-05",
      "title": "Bulletin de s\u00e9curit\u00e9 Nextcloud GHSA-495w-cqv6-wr59",
      "url": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-495w-cqv6-wr59"
    },
    {
      "published_at": "2025-12-05",
      "title": "Bulletin de s\u00e9curit\u00e9 Nextcloud GHSA-hq6c-r898-fgf2",
      "url": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-hq6c-r898-fgf2"
    },
    {
      "published_at": "2025-12-05",
      "title": "Bulletin de s\u00e9curit\u00e9 Nextcloud GHSA-2vrq-fhmf-c49m",
      "url": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-2vrq-fhmf-c49m"
    },
    {
      "published_at": "2025-12-05",
      "title": "Bulletin de s\u00e9curit\u00e9 Nextcloud GHSA-2cwj-qp49-4xfw",
      "url": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-2cwj-qp49-4xfw"
    },
    {
      "published_at": "2025-12-05",
      "title": "Bulletin de s\u00e9curit\u00e9 Nextcloud GHSA-qcw2-p26m-9gc5",
      "url": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-qcw2-p26m-9gc5"
    },
    {
      "published_at": "2025-12-05",
      "title": "Bulletin de s\u00e9curit\u00e9 Nextcloud GHSA-7x2j-2674-fj95",
      "url": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-7x2j-2674-fj95"
    },
    {
      "published_at": "2025-12-05",
      "title": "Bulletin de s\u00e9curit\u00e9 Nextcloud GHSA-v394-8gpc-6fv5",
      "url": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-v394-8gpc-6fv5"
    },
    {
      "published_at": "2025-12-05",
      "title": "Bulletin de s\u00e9curit\u00e9 Nextcloud GHSA-whm3-vv55-gf27",
      "url": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-whm3-vv55-gf27"
    },
    {
      "published_at": "2025-12-05",
      "title": "Bulletin de s\u00e9curit\u00e9 Nextcloud GHSA-xjvq-xvr7-xpg6",
      "url": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-xjvq-xvr7-xpg6"
    }
  ]
}

EUVD-2026-262672

European Vulnerability Database identifier assigned by ENISA

Reserved

2026-10-02 07:01

Assigner

ENISA

Alias of

a CVE record, shown under related vulnerabilities. This identifier carries no description, severity or references of its own: they belong to that CVE.

JSON

To clipboard

{
  "assigner": "ENISA",
  "date_reserved": "2026-10-02T07:01:24.556332+00:00",
  "id": "EUVD-2026-262672"
}

FKIE_CVE-2025-66546

Vulnerability from fkie_nvd - Published: 2025-12-05 17:16 - Updated: 2026-06-17 09:57

Severity

3.3 (Low) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Summary

References

URL	Tags
security-advisories@github.com	https://github.com/nextcloud/calendar/commit/f41650c3681fc4a4130eb883f5c0899c011326b3	Patch
security-advisories@github.com	https://github.com/nextcloud/calendar/pull/7537	Issue Tracking
security-advisories@github.com	https://github.com/nextcloud/security-advisories/security/advisories/GHSA-7x2j-2674-fj95	Patch, Vendor Advisory
security-advisories@github.com	https://hackerone.com/reports/3275810	Issue Tracking, Vendor Advisory

Impacted products

Vendor	Product	Version
nextcloud	calendar	*
nextcloud	calendar	*
nextcloud	calendar	6.0.0
nextcloud	calendar	6.0.0
nextcloud	calendar	6.0.0
nextcloud	calendar	6.0.0
nextcloud	calendar	6.0.0
nextcloud	calendar	6.0.0
nextcloud	calendar	6.0.0

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "security-advisories",
          "vendor": "nextcloud",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 6.0.0-rc.1, \u003c 6.0.1"
            },
            {
              "status": "affected",
              "version": "\u003e= 5.0.0-rc.1, \u003c 5.5.6"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.0.0-beta1, \u003c 4.7.19"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:nextcloud:calendar:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "84E1FFC4-516D-4680-9F67-E66C1FAE5E0B",
              "versionEndExcluding": "4.7.19",
              "versionStartIncluding": "4.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:nextcloud:calendar:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "3E716F13-981B-49BA-98FF-3B52C9962EA2",
              "versionEndExcluding": "5.5.6",
              "versionStartIncluding": "5.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:nextcloud:calendar:6.0.0:-:*:*:*:*:*:*",
              "matchCriteriaId": "5FEEB806-FB4C-42B4-BE4E-297AB95A854F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:nextcloud:calendar:6.0.0:rc1:*:*:*:*:*:*",
              "matchCriteriaId": "B1A878DF-8A9B-4987-8E2C-6873CA2C8427",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:nextcloud:calendar:6.0.0:rc2:*:*:*:*:*:*",
              "matchCriteriaId": "9B9884CA-4E88-4AB3-BA37-FAF9E845F04E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:nextcloud:calendar:6.0.0:rc3:*:*:*:*:*:*",
              "matchCriteriaId": "032400B7-AE78-467F-81CC-83164AC29796",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:nextcloud:calendar:6.0.0:rc4:*:*:*:*:*:*",
              "matchCriteriaId": "D1A265F6-884F-44FF-B00F-CB5F7E704E0E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:nextcloud:calendar:6.0.0:rc5:*:*:*:*:*:*",
              "matchCriteriaId": "8249ACE0-0485-4485-B628-D157E57A91C0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:nextcloud:calendar:6.0.0:rc6:*:*:*:*:*:*",
              "matchCriteriaId": "508556C9-5596-42B5-AD76-8156A42FEED7",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Nextcloud Calendar is a calendar app for Nextcloud. Prior to 4.7.19, 5.5.6, and 6.0.1, the calendar app allowed blindly booking appointments with a squential ID without known the appointment token. This vulnerability is fixed in 4.7.19, 5.5.6, and 6.0.1."
    }
  ],
  "id": "CVE-2025-66546",
  "lastModified": "2026-06-17T09:57:00.350",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "NONE",
          "baseScore": 3.3,
          "baseSeverity": "LOW",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 1.4,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-66546",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2025-12-05T18:32:11.684776Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2025-12-05T17:16:05.163",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/nextcloud/calendar/commit/f41650c3681fc4a4130eb883f5c0899c011326b3"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Issue Tracking"
      ],
      "url": "https://github.com/nextcloud/calendar/pull/7537"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-7x2j-2674-fj95"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Issue Tracking",
        "Vendor Advisory"
      ],
      "url": "https://hackerone.com/reports/3275810"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-639"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

WID-SEC-W-2025-2752

Vulnerability from csaf_certbund - Published: 2025-12-04 23:00 - Updated: 2025-12-07 23:00

Summary

Nextcloud: Mehrere Schwachstellen

Severity

Mittel

Scope

15 vulnerabilities in this advisory, including CVE-2025-66546.

CVE-2025-66546

Known affected: 9 products

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2025-66546 (GCVE-0-2025-66546)

BDU:2026-03580 (CVE-2025-66546)

CERTFR-2025-AVI-1066

Solutions

EUVD-2026-262672

FKIE_CVE-2025-66546

WID-SEC-W-2025-2752

Tags

Sightings

Nomenclature

Related by attack behaviour