What’s Vulnerable › Vulnerabilities

CVE-2025-66513: Nextcloud Tables app share information not limited to relevant users

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-12-05 · updated 2026-10-15
• Weakness: CWE-639

Description

Nextcloud Tables allows you to create your own tables with individual columns. Prior to 0.8.9, 0.9.6, and 1.0.1, the information which table (numeric ID) is shared with which groups or users and the respective permissions was not limited to privileged users. This vulnerability is fixed in 0.8.9, 0.9.6, and 1.0.1.

Affected products

• nextcloud Tables: from 0.6.0 before 0.8.9; from 0.9.0 before 0.9.6; from 1.0.0 before 1.0.1 — fixed in 0.8.9, 0.9.6, 1.0.1

How to fix

Upgrade to a fixed version: nextcloud Tables 0.8.9, 0.9.6, 1.0.1. Check the vendor advisory for mitigations.

References

• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-2cwj-qp49-4xfw
• https://github.com/nextcloud/tables/commit/b92b9560b1e70a02b103a7aeb9e22e2ab5231873
• https://github.com/nextcloud/tables/pull/2148
• https://hackerone.com/reports/3334165

Get alerted when CVE-2025-66513 or the next vulnerability affects your stack