← Back

CVE-2025-66546

nvd nist
Published: Dec 5, 2025Modified: Oct 18, 2026

JSON object

Loading...
3.3
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Exploitability: 1.8 / Impact: 1.4
Source: security-advisories@github.com (Secondary)

Description

Nextcloud Calendar is a calendar app for Nextcloud. Prior to 4.7.19, 5.5.6, and 6.0.1, the calendar app allowed blindly booking appointments with a squential ID without known the appointment token. This vulnerability is fixed in 4.7.19, 5.5.6, and 6.0.1.

Affected (9)

Products: Nextcloud: Calendar
Nextcloud
1 product
Calendar
Configuration A
9 vulnerable
Vulnerable SoftwareAffected Versions
Nextcloud
Calendar
4.0.0 ≤ version < 4.7.19
Calendar
5.0.0 ≤ version < 5.5.6
Calendar
Version 6.0.0
Calendar
Version 6.0.0 rc1
Calendar
Version 6.0.0 rc2
Calendar
Version 6.0.0 rc3
Calendar
Version 6.0.0 rc4
Calendar
Version 6.0.0 rc5
Calendar
Version 6.0.0 rc6

Related CWEs

CWE-639
Authorization Bypass Through User-Controlled Key
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

References (4)

Source: security-advisories@github.com
Patch
Source: security-advisories@github.com
Issue Tracking
Source: security-advisories@github.com
PatchVendor Advisory
Source: security-advisories@github.com
Issue TrackingVendor Advisory

Timeline

No history available yet.