CVE-2025-66511
Prior to 6.0.3, the Calendar app generates participant tokens for meeting proposals using a hash function, allowing an attacker to compute valid participant tokens, which allowed them to request details and submit dates in meeting proposals.
Does this matter?
Lower severity and a low EPSS score (0.29%). Track it; it rarely justifies an emergency change on its own.
Description
Nextcloud Calendar is a calendar app for Nextcloud. Prior to 6.0.3, the Calendar app generates participant tokens for meeting proposals using a hash function, allowing an attacker to compute valid participant tokens, which allowed them to request details and submit dates in meeting proposals. The tokens are not purely random generated. This vulnerability is fixed in 6.0.3.
- CVSS 3.1
- 6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
- EPSS
- 0.29% probability · 22th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-330
- Affected
- nextcloud/calendar
- Source
- security-advisories@github.com
References
- https://github.com/nextcloud/calendar/commit/8de14ae87f321f5f09280d9895a27d54d24f33fbPatch
- https://github.com/nextcloud/calendar/pull/7659Issue Tracking
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-whm3-vv55-gf27Patch, Vendor Advisory
- https://hackerone.com/reports/3385434Permissions Required, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.