← Back

CVE-2025-66511

nvd nist
Published: Dec 5, 2025Modified: Jun 17, 2026

JSON object

Loading...
6.5
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Exploitability: 3.9 / Impact: 2.5
Source: NVD

Description

Nextcloud Calendar is a calendar app for Nextcloud. Prior to 6.0.3, the Calendar app generates participant tokens for meeting proposals using a hash function, allowing an attacker to compute valid participant tokens, which allowed them to request details and submit dates in meeting proposals. The tokens are not purely random generated. This vulnerability is fixed in 6.0.3.

Affected (1)

Products: Nextcloud: Calendar
Nextcloud
1 product
Calendar
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Calendar
From 6.0.0 to 6.0.3

Related CWEs

CWE-330
Use of Insufficiently Random Values
The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.

References (4)

Source: security-advisories@github.com
Patch
Source: security-advisories@github.com
Issue Tracking
Source: security-advisories@github.com
PatchVendor Advisory
Source: security-advisories@github.com
Permissions RequiredVendor Advisory

Timeline

No history available yet.