← Back

CVE-2025-66510

nvd nist
Published: Dec 5, 2025Modified: Jun 17, 2026

JSON object

Loading...
4.9
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Exploitability: 1.2 / Impact: 3.6
Source: NVD

Description

Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server prior to 31.0.10 and 32.0.1 and Nextcloud Enterprise Server prior to 28.0.14.11, 29.0.16.8, 30.0.17.3, and 31.0.10, contacts search allowed to retrieve personal data of other users (emails, names, identifiers) without proper access control. This allows an authenticated user to retrieve information about accounts that are not related or added as contacts.

Affected (6)

Nextcloud
1 product
Nextcloud Server
Configuration A
6 vulnerable
Vulnerable SoftwareAffected Versions
Nextcloud
Nextcloud Server
From 31.0.0 to 31.0.10
Nextcloud Server
From 32.0.0 to 32.0.1
Nextcloud Server
From 28.0.0 to 28.0.14.11
Nextcloud Server
From 29.0.0 to 29.0.16.8
Nextcloud Server
From 30.0.0 to 30.0.17.3
Nextcloud Server
From 31.0.0 to 31.0.10

Related CWEs

CWE-359
Exposure of Private Personal Information to an Unauthorized Actor
The product does not properly prevent a person's private, personal information from being accessed by actors who either (1) are not explicitly authorized to access the information or (2) do not have the implicit consent of the person about whom the information is collected.

References (3)

Source: security-advisories@github.com
PatchVendor Advisory
Source: security-advisories@github.com
Patch
Source: security-advisories@github.com
Issue Tracking

Timeline

No history available yet.