CVE-2025-66513

Nextcloud Tables allows you to create your own tables with individual columns. Prior to 0.8.9, 0.9.6, and 1.0.1, the information which table (numeric ID) is shared with which groups or users and the respective permissions was not limited to privileged users. This vulnerability is fixed in 0.8.9, 0.9.6, and 1.0.1.

CVSS 3.1

5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS

0.3% chance of exploitation in the next 30 days; higher than 21% of CVEs (scores of 2026-10-25)

CWE

CWE-639

Published

2025-12-05

Modified

2026-10-15

Record from

the NVD, synced 2026-10-19

Affected

• nextcloud:tables

References

• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-2cwj-qp49-4xfw
• https://github.com/nextcloud/tables/commit/b92b9560b1e70a02b103a7aeb9e22e2ab5231873
• https://github.com/nextcloud/tables/pull/2148
• https://hackerone.com/reports/3334165

Check your stackJSON