Nextcloud Tables app share information not limited to relevant users
Priority LOW 24CWE-639Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-639.
Summary
Nextcloud Tables allows you to create your own tables with individual columns. Prior to 0.8.9, 0.9.6, and 1.0.1, the information which table (numeric ID) is shared with which groups or users and the respective permissions was not limited to privileged users. This vulnerability is fixed in 0.8.9, 0.9.6, and 1.0.1.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00316 24th percentileScored 2026-11-07
Fix Fixed security-advisories (nextcloud): 1.0.1, 0.9.6, 0.8.9
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| nextcloud | security-advisories | 1.0.0-beta.1 to before 1.0.1; 0.9.0-beta.1 to before 0.9.6; before 0.8.9 | 1.0.1, 0.9.6, 0.8.9 | Patch available | CNA |
- security-advisories Vendornextcloud Affected 1.0.0-beta.1 to before 1.0.1; 0.9.0-beta.1 to before 0.9.6; before 0.8.9 Fixed in 1.0.1, 0.9.6, 0.8.9 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:nextcloud:tables:*:*:*:*:*:nextcloud:*:* | 0.6.0 to before 0.8.9; 0.9.0 to before 0.9.6; 1.0.0 to before 1.0.1 | Vulnerable | nextcloud |
- cpe:2.3:a:nextcloud:tables:*:*:*:*:*:nextcloud:*:* Versions 0.6.0 to before 0.8.9; 0.9.0 to before 0.9.6; 1.0.0 to before 1.0.1 Vulnerable ·nextcloud
Remediation
- Fix · CNA security-advisories (nextcloud) Fixed in 1.0.1, 0.9.6, 0.8.9
Timeline
- 2026-10-02 Threatist record created from CVE-2025-66513
References
More nextcloud Tables vulnerabilities
- TI-2026-33296 Nextcloud: SQL Injection in Column Type Parameter Allows Arbitrary SQL Execution CVSS 3.1HIGH 8.2
- TI-2026-33461 Nextcloud: Tables app allows limited SQLi in ORDER BY with malicious sort order argument for Table Views CVSS 3.1HIGH 7.1
- TI-2024-35182 Nextcloud Tables has an Authorization Bypass Through User-Controlled Key in Tables CVSS 3.1MEDIUM 6.5
- TI-2025-40962 Nextcloud Tables is missing an ownership check which allows moving columns into tables of other users CVSS 3.1MEDIUM 6.3
- TI-2025-40964 Nextcloud Tables app allowed users to view columns metadata information of any table CVSS 3.1MEDIUM 4.3
- TI-2024-35178 Share information of the Nextcloud Tables app is not limited to affected users CVSS 3.1MEDIUM 4.3
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences