MEDIUM🇵🇱 Wersja polska

CVE-2025-66511

CVSS 4.8v3.1pub. 2025-12-05upd. 2025-12-10

Nextcloud Calendar is a calendar app for Nextcloud. Prior to 6.0.3, the Calendar app generates participant tokens for meeting proposals using a hash function, allowing an attacker to compute valid participant tokens, which allowed them to request details and submit dates in meeting proposals. The tokens are not purely random generated. This vulnerability is fixed in 6.0.3.

CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

  • Nextcloud Calendar

    APP
    Nextcloud
    6.0.0 – 6.0.3 (bez)
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2026-45286MEDIUM4.3ten sam produkt

Nextcloud is an open source content collaboration platform. From versions 5.5.13 to before 5.5.17, and 6.2.0 t...

CVE-2025-66550MEDIUM5.7ten sam produkt

Nextcloud Calendar is a calendar app for Nextcloud. Prior to 4.7.17 and 5.2.4, when a malicious user creates a...

CVE-2024-37316MEDIUM4.6ten sam produkt

Nextcloud Calendar is a calendar app for Nextcloud. Authenticated users could create an event with manipulated...

CVE-2023-45150MEDIUM4.3ten sam produkt

Nextcloud calendar is a calendar app for the Nextcloud server platform. Due to missing precondition checks the...

CVE-2022-24838MEDIUM5.3ten sam produkt

Nextcloud Calendar is a calendar application for the nextcloud framework. SMTP Command Injection in Appointmen...