CVE-2025-66546
published 2025-12-05CVE-2025-66546: Nextcloud Calendar is a calendar app for Nextcloud. Prior to 4.7.19, 5.5.6, and 6.0.1, the calendar app allowed blindly booking appointments with a squential…
PriorityP410low3.3CVSS 3.1
AVLACLPRLUINSUCLINAN
EPSS
0.14%
2.9th percentile
Nextcloud Calendar is a calendar app for Nextcloud. Prior to 4.7.19, 5.5.6, and 6.0.1, the calendar app allowed blindly booking appointments with a squential ID without known the appointment token. This vulnerability is fixed in 4.7.19, 5.5.6, and 6.0.1.
Affected
12 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| nextcloud | calendar | — | — |
| nextcloud | calendar | — | — |
| nextcloud | calendar | — | — |
| nextcloud | calendar | — | — |
| nextcloud | calendar | — | — |
| nextcloud | calendar | — | — |
| nextcloud | calendar | — | — |
| nextcloud | calendar | >= 4.0.0 < 4.7.19 | 4.7.19 |
| nextcloud | calendar | >= 5.0.0 < 5.5.6 | 5.5.6 |
| nextcloud | security-advisories | — | — |
| nextcloud | security-advisories | — | — |
| nextcloud | security-advisories | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No advisories linked to this vulnerability.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-12-05
Published