CVE-2025-66553

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-66553
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-66553.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-66553
Aliases
  • GHSA-p53h-6294-crjw
Published
2025-12-05T17:18:09.776Z
Modified
2026-04-10T05:34:27.047296Z
Severity
  • 4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
Summary
Nextcloud Tables app allowed users to view columns metadata information of any table
Details

Nextcloud Tables allows you to create your own tables with individual columns. Prior to 0.8.7 and 0.9.4, authenticated users were able to view meta data of columns in other tables of the Tables app by modifying the numeric ID in a request. This vulnerability is fixed in 0.8.7 and 0.9.4.

Database specific 
{
    "cwe_ids": [
        "CWE-639"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66553.json"
}
References

Affected packages

Git / github.com/nextcloud/tables

Affected ranges

Type
GIT
Repo
https://github.com/nextcloud/tables
Events
Introduced
942c7051ab61eca482370149c0459f196bbb56b3
Fixed
7aefa59293b144ce242ff2a2340ff654b7361870
Database specific 
{
    "versions": [
        {
            "introduced": "0.9.0-beta.1"
        },
        {
            "fixed": "0.9.4"
        }
    ]
}
Type
GIT
Repo
https://github.com/nextcloud/tables
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
c6a825e4bd178d648c4149d5f9fc9900532e9c15
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.8.7"
        }
    ]
}

Affected versions

v0.*
v0.2.2rc1
v0.3.0
v0.3.1
v0.3.2
v0.3.3
v0.4.0
v0.5.0
v0.5.1
v0.6.0
v0.6.0-beta.1
v0.6.0-beta.2
v0.6.0-beta.3
v0.6.0-beta.4
v0.7.0
v0.7.0-beta.1
v0.7.0-beta.2
v0.7.0-beta.3
v0.8.0-beta.1
v0.8.0-beta.2
v0.8.0-beta.3
v0.8.1
v0.8.2
v0.8.3
v0.8.4
v0.8.5
v0.8.6
v0.9.0
v0.9.0-beta.1
v0.9.0-beta.2
v0.9.1
v0.9.2
v0.9.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-66553.json"