CVE-2025-66546

LowCVSS 3.3/10Last modified Oct 18, 2026

Description

Nextcloud Calendar is a calendar app for Nextcloud. Prior to 4.7.19, 5.5.6, and 6.0.1, the calendar app allowed blindly booking appointments with a squential ID without known the appointment token. This vulnerability is fixed in 4.7.19, 5.5.6, and 6.0.1.

Metrics

CVSS 3.1 3.3/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-639

Affected software

Vendor	Product	Versions
nextcloud	security-advisories	>= 6.0.0-rc.1, < 6.0.1; >= 5.0.0-rc.1, < 5.5.6; >= 3.0.0-beta1, < 4.7.19

References

https://github.com/nextcloud/calendar/commit/f41650c3681fc4a4130eb883f5c0899c011326b3Patch
https://github.com/nextcloud/calendar/pull/7537Issue Tracking
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-7x2j-2674-fj95Patch, Vendor Advisory
https://hackerone.com/reports/3275810Issue Tracking, Vendor Advisory

Timeline

Published: Dec 5, 2025
Last modified: Oct 18, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-665474.3Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server and Enterprise Server prior to 31.0.1, non-privileged users can CVE-2025-665485.5Nextcloud Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. CVE-2025-665492.7Nextcloud Desktop is the desktop sync client for Nextcloud. Prior to 3.16.5, when trying to manually lock a file inside an end-to-end encryp CVE-2025-66553.3PDF-XChange Editor PRC File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to d CVE-2025-665505.7Nextcloud Calendar is a calendar app for Nextcloud. Prior to 4.7.17 and 5.2.4, when a malicious user creates a calendar event with a crafted CVE-2025-665514.3Nextcloud Tables allows you to create your own tables with individual columns. Prior to 0.8.6 and 0.9.3, a malicious user was able to create CVE-2025-665524.3Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server and Enterprise Server prior to 30.0.9 and 31.0.1, incorrect pat CVE-2025-665534.3Nextcloud Tables allows you to create your own tables with individual columns. Prior to 0.8.7 and 0.9.4, authenticated users were able to vi CVE-2025-665545.4Contacts app for Nextcloud easily syncs contacts from various devices with your Nextcloud and allows editing. Prior to 5.5.4, 6.0.6, and 7.2 CVE-2025-665558.8AirKeyboard iOS App 1.0.5 contains a missing authentication vulnerability that allows unauthenticated attackers to type arbitrary keystrokes CVE-2025-665564.3Nextcloud talk is a video & audio conferencing app for Nextcloud. Prior to 20.1.8 and 21.1.2, a participant with chat permissions was able t CVE-2025-665574.3Nextcloud Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud.