CVE-2025-66547

Published: Dec 5, 2025Modified: Jun 17, 2026

4.3

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Exploitability: 2.8 / Impact: 1.4

Source: security-advisories@github.com (Secondary)

Description

Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server and Enterprise Server prior to 31.0.1, non-privileged users can modify tags on files they should not have access to via bulk tagging. This vulnerability is fixed in 31.0.1.

Affected (2)

Products: Nextcloud: Nextcloud Server

Nextcloud

1 product

Nextcloud Server

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Nextcloud Nextcloud Server	From 31.0.0 to 31.0.1
Nextcloud Nextcloud Server	From 31.0.0 to 31.0.1

Related CWEs

CWE-639

Authorization Bypass Through User-Controlled Key

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.