CVE-2025-66510

MEDIUM EPSS 21.4%
Published Dec 5, 20256mo ago · Modified Jun 17, 20262w ago
4.9 CVSS 3.1
Medium
Find Similar
Published Dec 5, 2025 6mo ago
Last Modified Jun 17, 2026 2w ago

Description

Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server prior to 31.0.10 and 32.0.1 and Nextcloud Enterprise Server prior to 28.0.14.11, 29.0.16.8, 30.0.17.3, and 31.0.10, contacts search allowed to retrieve personal data of other users (emails, names, identifiers) without proper access control. This allows an authenticated user to retrieve information about accounts that are not related or added as contacts.

CVSS Details

Base Score
4.9
Exploitability
1.2
Impact
3.6
Vector string
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required High
User Interaction None
Scope Unchanged
Confidentiality High
Integrity None
Availability None

Threat Intelligence

EPSS Exploit Probability
21.4% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-359

Affected Products 6

VendorProductVersionRange
nextcloudnextcloud_server*≥28.0.0  –  <28.0.14.11
nextcloudnextcloud_server*≥29.0.0  –  <29.0.16.8
nextcloudnextcloud_server*≥30.0.0  –  <30.0.17.3
nextcloudnextcloud_server*≥31.0.0  –  <31.0.10
nextcloudnextcloud_server*≥31.0.0  –  <31.0.10
nextcloudnextcloud_server*≥32.0.0  –  <32.0.1

References 3

  • github.com https://github.com/nextcloud/security-advisories/security/advisories/GHSA-495w-cqv6-wr59
    PatchVendor Advisory
  • github.com https://github.com/nextcloud/server/commit/e4866860cbf24a746eb8a125587262a4c8831c57
    Patch
  • github.com https://github.com/nextcloud/server/pull/55657
    Issue Tracking

Remediation

  • github.com https://github.com/nextcloud/security-advisories/security/advisories/GHSA-495w-cqv6-wr59
    PatchVendor Advisory
  • github.com https://github.com/nextcloud/server/commit/e4866860cbf24a746eb8a125587262a4c8831c57
    Patch