CVE-2025-59716

MediumCVSS 5.3/10Last modified Nov 5, 2026

Description

ownCloud Guests before 0.12.5 allows unauthenticated user enumeration via the /apps/guests/register/{email}/{token} endpoint. Because of insufficient validation of the supplied token in showPasswordForm, the server responds differently when an e-mail address corresponds to a valid pending guest user rather than a non-existent user.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200 CWE-203

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://gist.github.com/thesmartshadow/64ae0449e909174d0479a4f23657147fExploit, Third Party Advisory
https://github.com/owncloud/guestsProduct
https://marketplace.owncloud.com/apps/guestsProduct
https://yeswehack.com/reports/411806Permissions Required

Timeline

Published: Nov 5, 2025
Last modified: Nov 5, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-597179.8In the @digitalocean/do-markdownit package through 1.16.1 (in npm), the callout and fence_environment plugins perform .includes substring ma CVE-2025-597189.8A improper verification of cryptographic signature vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, Forti CVE-2025-597199.8An improper verification of cryptographic signature vulnerability in Fortinet FortiWeb 8.0.0, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 t CVE-2025-59725.4A vulnerability classified as problematic has been found in PHPGurukul Restaurant Table Booking System 1.0. Affected is an unknown function CVE-2025-597288.7When calculating the content path in handling of MPEG-DASH manifests, there's an out-of-bounds NUL-byte write one byte past the end of the b CVE-2025-597295.7When parsing the header for a DHAV file, there's an integer underflow in offset calculation that leads to reading the duration from before t CVE-2025-59735.4A vulnerability classified as problematic was found in PHPGurukul Restaurant Table Booking System 1.0. Affected by this vulnerability is an CVE-2025-597305.7When decoding a frame for a SANM file (ANIM v0 variant), the decoded data can be larger than the buffer allocated for it. Frames encoded wi CVE-2025-597316.9When decoding an OpenEXR file that uses DWAA or DWAB compression, the specified raw length of run-length-encoded data is not checked when us CVE-2025-597328.7When decoding an OpenEXR file that uses DWAA or DWAB compression, there's an implicit assumption that the height and width are divisible by CVE-2025-597338.7When decoding an OpenEXR file that uses DWAA or DWAB compression, there's an implicit assumption that all image channels have the same pixel CVE-2025-597348.7It is possible to cause an use-after-free write in SANM decoding with a carefully crafted animation using subversion <2. When a STOR chunk