MEDIUM🇵🇱 Wersja polska

CVE-2025-66511

CVSS 4.8v3.1pub. 2025-12-05upd. 2025-12-10

Nextcloud Calendar is a calendar app for Nextcloud. Prior to 6.0.3, the Calendar app generates participant tokens for meeting proposals using a hash function, allowing an attacker to compute valid participant tokens, which allowed them to request details and submit dates in meeting proposals. The tokens are not purely random generated. This vulnerability is fixed in 6.0.3.

CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

  • Nextcloud Calendar

    APP
    Nextcloud
    6.0.0 – 6.0.3 (excl.)
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2026-45286MEDIUM4.3same product

Nextcloud to otwarta platforma współpracy przy zawartości. W wersjach od 5.5.13 do 5.5.16 oraz od 6.2.0 do 6.2...

CVE-2025-66550MEDIUM5.7same product

Nextcloud Calendar to aplikacja kalendarza dla Nextcloud. W wersjach przed 4.7.17 i 5.2.4, złośliwy użytkownik...

CVE-2024-37316MEDIUM4.6same product

Nextcloud Calendar is a calendar app for Nextcloud. Authenticated users could create an event with manipulated...

CVE-2023-45150MEDIUM4.3same product

Nextcloud calendar is a calendar app for the Nextcloud server platform. Due to missing precondition checks the...

CVE-2022-24838MEDIUM5.3same product

Nextcloud Calendar is a calendar application for the nextcloud framework. SMTP Command Injection in Appointmen...