BIT-nextcloud-2025-66510

See a problem?
Import Source
https://github.com/bitnami/vulndb/tree/main/data/nextcloud/BIT-nextcloud-2025-66510.json
JSON Data
https://api.osv.dev/v1/vulns/BIT-nextcloud-2025-66510
Aliases
Published
2026-07-13T09:29:25.570Z
Modified
2026-07-13T10:11:29.304655573Z
Summary
Nextcloud Server Contacts Search allowed users to retrieve contact information of other users beyond their contact list
Details

Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server prior to 31.0.10 and 32.0.1 and Nextcloud Enterprise Server prior to 28.0.14.11, 29.0.16.8, 30.0.17.3, and 31.0.10, contacts search allowed to retrieve personal data of other users (emails, names, identifiers) without proper access control. This allows an authenticated user to retrieve information about accounts that are not related or added as contacts.

Database specific 
{
    "cpes": [
        "cpe:2.3:a:nextcloud:nextcloud:*:*:*:*:*:*:*:*"
    ],
    "severity": "Medium"
}
References

Affected packages

Bitnami / nextcloud

Package

Name
nextcloud
Purl
pkg:bitnami/nextcloud

Severity

  • 4.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Affected ranges

Type
SEMVER
Events
Introduced
31.0.0
Fixed
31.0.10
Introduced
32.0.0
Fixed
32.0.1

Database specific

source 
"https://github.com/bitnami/vulndb/tree/main/data/nextcloud/BIT-nextcloud-2025-66510.json"