CVE-2025-66511

Nextcloud Calendar is a calendar app for Nextcloud. Prior to 6.0.3, the Calendar app generates participant tokens for meeting proposals using a hash function, allowing an attacker to compute valid participant tokens, which allowed them to request details and submit dates in meeting proposals. The tokens are not purely random generated. This vulnerability is fixed in 6.0.3.

CVSS 3.1

6.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

EPSS

0.3% chance of exploitation in the next 30 days; higher than 21% of CVEs (scores of 2026-10-25)

CWE

CWE-330

Published

2025-12-05

Modified

2026-10-18

Record from

the NVD, synced 2026-10-19

Affected

• nextcloud:calendar

References

• https://github.com/nextcloud/calendar/commit/8de14ae87f321f5f09280d9895a27d54d24f33fb
• https://github.com/nextcloud/calendar/pull/7659
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-whm3-vv55-gf27
• https://hackerone.com/reports/3385434

Check your stackJSON