VulnerabilityAnalyzed

CVE-2025-66510

In Nextcloud Server prior to 31.0.10 and 32.0.1 and Nextcloud Enterprise Server prior to 28.0.14.11, 29.0.16.8, 30.0.17.3, and 31.0.10, contacts search allowed to retrieve personal data of other users (emails, names, identifiers) without proper access…

MEDIUM 4.9EPSS 0.36%

Does this matter?

Lower severity and a low EPSS score (0.36%). Track it; it rarely justifies an emergency change on its own.

Description

Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server prior to 31.0.10 and 32.0.1 and Nextcloud Enterprise Server prior to 28.0.14.11, 29.0.16.8, 30.0.17.3, and 31.0.10, contacts search allowed to retrieve personal data of other users (emails, names, identifiers) without proper access control. This allows an authenticated user to retrieve information about accounts that are not related or added as contacts.

CVSS 3.1: 4.9 MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
EPSS: 0.36% probability · 29th percentile
CISA KEV: Not listed
Weakness: CWE-359
Affected: nextcloud/nextcloud server
Source: security-advisories@github.com

References

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-495w-cqv6-wr59Patch, Vendor Advisory
https://github.com/nextcloud/server/commit/e4866860cbf24a746eb8a125587262a4c8831c57Patch
https://github.com/nextcloud/server/pull/55657Issue Tracking

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.