This blog post discusses a security flaw found in the Nextcloud Tables application, identified as CVE-2025-66553. This vulnerability could allow an attacker to gain unauthorized access to certain information within your Nextcloud environment. Keeping your software updated is crucial for maintaining a strong security posture.
CVE Details
This particular vulnerability affects the Nextcloud Tables application. It was first made public on December 5, 2025. The overall severity has been rated as Medium, and its status is “Analyzed”, meaning the details have been reviewed and assessed.
Overview
The Nextcloud Tables app lets users create and manage their own tables with custom columns. However, a security flaw existed where an authenticated user could peek at the “meta data” (think of it as descriptive information) of columns in other tables they weren’t supposed to access. This was possible by simply changing a numeric ID in their request to the application. This means a user with legitimate access to some tables could potentially snoop on the structure of other tables, even if they didn’t have permission to see the actual content of those other tables.
Affected Products
The vulnerability impacts Nextcloud Tables versions prior to 0.8.7 and 0.9.4. Specifically, any installations running versions from 0.8.0 up to (but not including) 0.8.7, and versions from 0.9.0 up to (but not including) 0.9.4 are at risk.
Current Status
This vulnerability has been thoroughly analyzed. Important patches are available to address the issue.
Severity Level
The Common Vulnerability Scoring System (CVSS) rates this vulnerability with a score of 4.3 out of 10, categorizing it as “Medium” severity. This rating indicates that while an attack requires the user to be authenticated, and only results in a low impact on confidentiality (meaning only metadata is exposed, not full data), it’s still a concern that should be addressed promptly to maintain data privacy and system integrity. It’s an authorization bypass issue where a user-controlled key (the numeric ID) can lead to unauthorized information disclosure.
Possible Solutions
To safeguard your Nextcloud instance, it is highly recommended to update your Nextcloud Tables application to one of the patched versions: 0.8.7 or 0.9.4. These updates contain the necessary fixes to prevent this information disclosure.
If immediate updating isn’t feasible, a temporary workaround is to disable the Nextcloud Tables app entirely. While this will protect against the vulnerability, it will also mean that the functionality of the Tables app will be unavailable. Prioritize applying the patches as soon as possible.
References
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-p53h-6294-crjw
https://github.com/nextcloud/tables/commit/e975f5bfedb6922f04cdd236cde4e26067fe064e
https://github.com/nextcloud/tables/pull/1891
https://hackerone.com/reports/3138721
