CVE-2025-66551
BaseFortify
Publication date: 2025-12-05
Last updated on: 2025-12-09
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| nextcloud | tables | From 0.4.0 (inc) to 0.8.6 (exc) |
| nextcloud | tables | From 0.9.0 (inc) to 0.9.3 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-639 | The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in Nextcloud Tables allowed a malicious user to create their own table and then move a column into another user's table, potentially altering data in the victim's table. It affects versions prior to 0.8.6 and 0.9.3 and has been fixed in those versions.
How can this vulnerability impact me? :
The vulnerability can impact you by allowing an attacker with limited privileges to modify data in another user's table, potentially leading to data integrity issues or unauthorized data manipulation.
What immediate steps should I take to mitigate this vulnerability?
Update Nextcloud Tables to version 0.8.6 or 0.9.3 or later, as these versions contain the fix for this vulnerability.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows unauthorized modification of another user's data by moving columns between tables without proper authorization checks. While it does not impact data confidentiality, it poses a high integrity risk by enabling unauthorized data modification. Such integrity violations can affect compliance with standards like GDPR and HIPAA, which require protecting data integrity and preventing unauthorized data alterations. Therefore, organizations using vulnerable versions of Nextcloud Tables may face compliance risks related to data integrity requirements under these regulations. [3]