CVE-2025-66553

low-risk

Published 2025-12-05

Nextcloud Tables allows you to create your own tables with individual columns. Prior to 0.8.7 and 0.9.4, authenticated users were able to view meta data of columns in other tables of the Tables app by modifying the numeric ID in a request. This vulnerability is fixed in 0.8.7 and 0.9.4.

Do I need to act?

0.02% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 4.3/10 Medium

NETWORK / LOW complexity

Affected Products (1)

Tables

Affected Vendors

Nextcloud

References (4)

Patch https://github.com/nextcloud/security-advisories/security/advisories/GHSA-p53h-6...

Patch https://github.com/nextcloud/tables/commit/e975f5bfedb6922f04cdd236cde4e26067fe0...

Issue Tracking https://github.com/nextcloud/tables/pull/1891

Issue Tracking https://hackerone.com/reports/3138721

/ 100

low-risk

Severity 18/34 · Moderate

Exploitability 0/34 · Minimal

Exposure 5/34 · Minimal