Baitaphish
Security intelligence
SearchLatest briefing
CVE Explorer

CVE-2025-66547

Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server and Enterprise Server prior to 31.0.1, non-privileged users can modify tags on files they should not have access to via bulk tagging. This vulnerability is fixed in 31.0.1.
Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:c60418e9dd9060ca34196e5bf22f8e69c5bb64423c425a2703f4ff0612611ca2
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
0

Affected products and versions

1 source assertion
{"product":"security-advisories","vendor":"nextcloud","versions":[{"status":"affected","version":"< 31.0.1"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:3a2488ad5afcb713e04b73dee27708b11f0c172457947c50a7659ef07ceb24d9 · sha256:9c1e0d7c526c75da… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion
{"metric":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"metric_type":"cvssV3_1"}
  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:3a2488ad5afcb713e04b73dee27708b11f0c172457947c50a7659ef07ceb24d9 · sha256:9c1e0d7c526c75da… · /containers/cna/metrics/0/cvssV3_1

CWE assertions

1 source assertion
{"cweId":"CWE-639","description":"CWE-639: Authorization Bypass Through User-Controlled Key","lang":"en","type":"CWE"}
  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:3a2488ad5afcb713e04b73dee27708b11f0c172457947c50a7659ef07ceb24d9 · sha256:9c1e0d7c526c75da… · /containers/cna/problemTypes/0/descriptions/0

Source references

5 source assertions
{"name":"https://github.com/nextcloud/security-advisories/security/advisories/GHSA-hq6c-r898-fgf2","tags":["x_refsource_CONFIRM"],"url":"https://github.com/nextcloud/security-advisories/security/advisories/GHSA-hq6c-r898-fgf2"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:3a2488ad5afcb713e04b73dee27708b11f0c172457947c50a7659ef07ceb24d9 · sha256:9c1e0d7c526c75da… · /containers/cna/references/0
{"name":"https://github.com/nextcloud/server/commit/b44f1568f2dc97c746281d99e2342ad679e3d8a9","tags":["x_refsource_MISC"],"url":"https://github.com/nextcloud/server/commit/b44f1568f2dc97c746281d99e2342ad679e3d8a9"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:3a2488ad5afcb713e04b73dee27708b11f0c172457947c50a7659ef07ceb24d9 · sha256:9c1e0d7c526c75da… · /containers/cna/references/3
{"name":"https://github.com/nextcloud/server/issues/51247","tags":["x_refsource_MISC"],"url":"https://github.com/nextcloud/server/issues/51247"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:3a2488ad5afcb713e04b73dee27708b11f0c172457947c50a7659ef07ceb24d9 · sha256:9c1e0d7c526c75da… · /containers/cna/references/1
{"name":"https://github.com/nextcloud/server/pull/51288","tags":["x_refsource_MISC"],"url":"https://github.com/nextcloud/server/pull/51288"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:3a2488ad5afcb713e04b73dee27708b11f0c172457947c50a7659ef07ceb24d9 · sha256:9c1e0d7c526c75da… · /containers/cna/references/2
{"name":"https://hackerone.com/reports/3040887","tags":["x_refsource_MISC"],"url":"https://hackerone.com/reports/3040887"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:3a2488ad5afcb713e04b73dee27708b11f0c172457947c50a7659ef07ceb24d9 · sha256:9c1e0d7c526c75da… · /containers/cna/references/4

Attribution and limitations

  • CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer