216.73.216.133

CVE-2025-66510

· Published 05/12/2025 17:16 · Modified 10/12/2025 16:12

Labels: CVE-2025-66510 2025-12-05CVE-2025-66510CWE-359[email protected]

Essential information

Published
05/12/2025 17:16
Modified
10/12/2025 16:12
Author
—
Creator
—
CVSS
4.5 MEDIUM (v3.1)
CISA KEV
No
CWE
—
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N

CVSS metrics

Description

Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server prior to 31.0.10 and 32.0.1 and Nextcloud Enterprise Server prior to 28.0.14.11, 29.0.16.8, 30.0.17.3, and 31.0.10, contacts search allowed to retrieve personal data of other users (emails, names, identifiers) without proper access control. This allows an authenticated user to retrieve information about accounts that are not related or added as contacts.

NVD status

Status
Analyzed — CVE has had analysis completed and all data associations made.
Source
[email protected]
NVD
View on NVD

Affected products (CPE)

ProductCPE
nextcloud / nextcloud server cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:enterprise:*:*:*
nextcloud / nextcloud server cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:enterprise:*:*:*
nextcloud / nextcloud server cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:enterprise:*:*:*
nextcloud / nextcloud server cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:-:*:*:*
nextcloud / nextcloud server cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:enterprise:*:*:*
nextcloud / nextcloud server cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:-:*:*:*

References