Data privacy and security are paramount, especially when handling personal or sensitive files in cloud storage solutions. Recently, a notable security flaw was discovered in Nextcloud Server, a popular open-source file hosting service. This vulnerability, identified as an Insecure Direct Object Reference (IDOR), allowed authenticated users to bypass normal access controls and view previews of files belonging to other users, even if those files were never explicitly shared. This means private documents, images, and other sensitive data could potentially be exposed without authorization. The good news is that Nextcloud has already addressed this issue in subsequent updates.
CVE Details
Product: Nextcloud Server
CVE ID: CVE-2025-64011
Published: December 12, 2025
Severity: Medium
Status: Analyzed
Affected Products
The vulnerability specifically impacts:
- Nextcloud Server version 30.0.0
This issue resided within the /core/preview endpoint of the Nextcloud Server software.
Current Status
This vulnerability has been thoroughly analyzed. The good news is that Nextcloud has already provided a fix for this issue.
Severity Level
Rated as “Medium” severity, this Insecure Direct Object Reference (IDOR) flaw could have significant consequences. While it requires an attacker to be an authenticated user on the Nextcloud instance, it grants them unauthorized access to sensitive information. The ability for any logged-in user to view previews of other users’ unshared files could lead to serious data privacy breaches, especially in environments where sensitive documents are stored. Although it doesn’t allow full file download or modification, the disclosure of file content previews is still a considerable risk.
Possible Solutions
The Nextcloud team has acted promptly to address this vulnerability. The issue has been fixed in newer releases. Specifically, Nextcloud Server version 31.0.9.1 and later releases include the necessary patches to resolve this IDOR vulnerability.
To protect your Nextcloud instance and ensure the privacy of your users’ data, it is strongly recommended that all users running Nextcloud Server 30.0.0 upgrade their installations immediately to a patched version. Regularly updating your Nextcloud instance is a critical step in maintaining a secure environment and guarding against known vulnerabilities.
References
https://drive.google.com/file/d/1eD3PN-u1caZYgGH96XHmJ7h_OBXEAHW4/view?usp=sharing
https://gist.github.com/tarekramm/586dfe2d113fedfee6d71182570fc090
https://nextcloud.com
