CVE-2025-66547

EPSS 0.03%
Veröffentlicht 05.12.2025 16:32:17
Zuletzt bearbeitet 09.12.2025 16:31:38
Quelle security-advisories@github.com
CVE-Watchlists
Login
Unerledigt
Login

Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server and Enterprise Server prior to 31.0.1, non-privileged users can modify tags on files they should not have access to via bulk tagging. This vulnerability is fixed in 31.0.1.

Betroffene Produkte Warnungen 0 Metriken 2 CWE 1 Referenzen 8

Verknüpft mit AI von unstrukturierten Daten zu bestehenden CPE der NVD

Diese Information steht angemeldeten Benutzern zur Verfügung.

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Nextcloud ≫ Nextcloud Server SwEdition- Version >= 31.0.0 < 31.0.1

Nextcloud ≫ Nextcloud Server SwEditionenterprise Version >= 31.0.0 < 31.0.1

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.03%	0.072

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
security-advisories@github.com	4.3	2.8	1.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

CWE-639 Authorization Bypass Through User-Controlled Key

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-hq6c-r898-fgf2

Patch

Vendor Advisory

https://github.com/nextcloud/server/issues/51247

Issue Tracking

https://github.com/nextcloud/server/pull/51288

Issue Tracking

https://github.com/nextcloud/server/commit/b44f1568f2dc97c746281d99e2342ad679e3d8a9

Patch

https://hackerone.com/reports/3040887

Vendor Advisory

Permissions Required

https://nvd.nist.gov/vuln/detail/CVE-2025-66547

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2025-66547

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2025-66547

EUVD