CVE-2025-66546

CWE-639 — Insecure Direct Object Reference2 documents2 sources
Severity
3.3LOW
EPSS
0.0%
top 99.11%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Nextcloud CalendarNextcloud Security-advisories
Timeline
PublishedDec 5

Description

Nextcloud Calendar is a calendar app for Nextcloud. Prior to 4.7.19, 5.5.6, and 6.0.1, the calendar app allowed blindly booking appointments with a squential ID without known the appointment token. This vulnerability is fixed in 4.7.19, 5.5.6, and 6.0.1.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NExploitability: 1.8 | Impact: 1.4

Affected Packages2 packages

▶NVDnextcloud/calendar4.0.0 — 4.7.19+2
▶CVEListV5nextcloud/security-advisories>= 3.0.0-beta1, < 4.7.19, >= 5.0.0-rc.1, < 5.5.6, >= 6.0.0-rc.1, < 6.0.1+2

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

1
CVEList
Nextcloud Calendar app allowed booking appointments without the generated token↗2025-12-05
▶