CVE-2025-66513

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-66513
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-66513.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-66513
Aliases
  • GHSA-2cwj-qp49-4xfw
Published
2025-12-05T17:11:19.774Z
Modified
2026-04-10T05:34:23.404610Z
Severity
  • 4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N CVSS Calculator
Summary
Nextcloud Tables app share information not limited to relevant users
Details

Nextcloud Tables allows you to create your own tables with individual columns. Prior to 0.8.9, 0.9.6, and 1.0.1, the information which table (numeric ID) is shared with which groups or users and the respective permissions was not limited to privileged users. This vulnerability is fixed in 0.8.9, 0.9.6, and 1.0.1.

Database specific 
{
    "cwe_ids": [
        "CWE-639"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66513.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/nextcloud/tables

Affected ranges

Type
GIT
Repo
https://github.com/nextcloud/tables
Events
Introduced
63305f051097c08eb53b3e93a440e45274fdb33f
Fixed
af1d57ddf5ffbb15a6a11d4c9c426acd1325fa10
Database specific 
{
    "versions": [
        {
            "introduced": "1.0.0-beta.1"
        },
        {
            "fixed": "1.0.1"
        }
    ]
}
Type
GIT
Repo
https://github.com/nextcloud/tables
Events
Introduced
942c7051ab61eca482370149c0459f196bbb56b3
Fixed
3b285158b02d8de83f300557db7894928a48543e
Database specific 
{
    "versions": [
        {
            "introduced": "0.9.0-beta.1"
        },
        {
            "fixed": "0.9.6"
        }
    ]
}
Type
GIT
Repo
https://github.com/nextcloud/tables
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
7dbb2be85b3651a08dc876edf00955a6806456b5
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.8.9"
        }
    ]
}

Affected versions

v0.*
v0.2.2rc1
v0.3.0
v0.3.1
v0.3.2
v0.3.3
v0.4.0
v0.5.0
v0.5.1
v0.6.0
v0.6.0-beta.1
v0.6.0-beta.2
v0.6.0-beta.3
v0.6.0-beta.4
v0.7.0
v0.7.0-beta.1
v0.7.0-beta.2
v0.7.0-beta.3
v0.8.0-beta.1
v0.8.0-beta.2
v0.8.0-beta.3
v0.8.1
v0.8.2
v0.8.3
v0.8.4
v0.8.5
v0.8.6
v0.8.7
v0.8.8
v0.9.0
v0.9.0-beta.1
v0.9.0-beta.2
v0.9.1
v0.9.2
v0.9.3
v0.9.4
v0.9.5
v1.*
v1.0.0
v1.0.0-beta.1
v1.0.0-beta.2
v1.0.0-beta.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-66513.json"