CVE-2025-66551

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-66551
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-66551.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-66551
Aliases
  • GHSA-w787-vwqp-8wr7
Published
2025-12-05T17:15:16.927Z
Modified
2026-04-10T05:34:27.562021Z
Severity
  • 6.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:L CVSS Calculator
Summary
Nextcloud Tables is missing an ownership check which allows moving columns into tables of other users
Details

Nextcloud Tables allows you to create your own tables with individual columns. Prior to 0.8.6 and 0.9.3, a malicious user was able to create their own table and then move a column to a victims table. This vulnerability is fixed in 0.8.6 and 0.9.3.

Database specific 
{
    "cwe_ids": [
        "CWE-639"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66551.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/nextcloud/tables

Affected ranges

Type
GIT
Repo
https://github.com/nextcloud/tables
Events
Introduced
942c7051ab61eca482370149c0459f196bbb56b3
Fixed
e33e28a239d8c4bbed12f73c9edd002e0cfe85bc
Database specific 
{
    "versions": [
        {
            "introduced": "0.9.0-beta.1"
        },
        {
            "fixed": "0.9.3"
        }
    ]
}
Type
GIT
Repo
https://github.com/nextcloud/tables
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
3ea4977dfb54b89e9195b8e20cc32965812fd522
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.8.6"
        }
    ]
}

Affected versions

v0.*
v0.2.2rc1
v0.3.0
v0.3.1
v0.3.2
v0.3.3
v0.4.0
v0.5.0
v0.5.1
v0.6.0
v0.6.0-beta.1
v0.6.0-beta.2
v0.6.0-beta.3
v0.6.0-beta.4
v0.7.0
v0.7.0-beta.1
v0.7.0-beta.2
v0.7.0-beta.3
v0.8.0-beta.1
v0.8.0-beta.2
v0.8.0-beta.3
v0.8.1
v0.8.2
v0.8.3
v0.8.4
v0.8.5
v0.9.0
v0.9.0-beta.1
v0.9.0-beta.2
v0.9.1
v0.9.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-66551.json"