CVE-2025-66546

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-66546", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2025-12-04T15:52:26.549Z", "datePublished": "2025-12-05T16:49:46.553Z", "dateUpdated": "2025-12-05T18:32:44.271Z"}, "containers": {"cna": {"title": "Nextcloud Calendar app allowed booking appointments without the generated token", "problemTypes": [{"descriptions": [{"cweId": "CWE-639", "lang": "en", "description": "CWE-639: Authorization Bypass Through User-Controlled Key", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 3.3, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-7x2j-2674-fj95", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-7x2j-2674-fj95"}, {"name": "https://github.com/nextcloud/calendar/pull/7537", "tags": ["x_refsource_MISC"], "url": "https://github.com/nextcloud/calendar/pull/7537"}, {"name": "https://github.com/nextcloud/calendar/commit/f41650c3681fc4a4130eb883f5c0899c011326b3", "tags": ["x_refsource_MISC"], "url": "https://github.com/nextcloud/calendar/commit/f41650c3681fc4a4130eb883f5c0899c011326b3"}, {"name": "https://hackerone.com/reports/3275810", "tags": ["x_refsource_MISC"], "url": "https://hackerone.com/reports/3275810"}], "affected": [{"vendor": "nextcloud", "product": "security-advisories", "versions": [{"version": ">= 6.0.0-rc.1, < 6.0.1", "status": "affected"}, {"version": ">= 5.0.0-rc.1, < 5.5.6", "status": "affected"}, {"version": ">= 3.0.0-beta1, < 4.7.19", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-12-05T16:49:46.553Z"}, "descriptions": [{"lang": "en", "value": "Nextcloud Calendar is a calendar app for Nextcloud. Prior to 4.7.19, 5.5.6, and 6.0.1, the calendar app allowed blindly booking appointments with a squential ID without known the appointment token. This vulnerability is fixed in 4.7.19, 5.5.6, and 6.0.1."}], "source": {"advisory": "GHSA-7x2j-2674-fj95", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-05T18:32:11.684776Z", "id": "CVE-2025-66546", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-05T18:32:44.271Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-66546", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-05T18:32:11.684776Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-05T18:32:34.528Z"}}], "cna": {"title": "Nextcloud Calendar app allowed booking appointments without the generated token", "source": {"advisory": "GHSA-7x2j-2674-fj95", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.3, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "nextcloud", "product": "security-advisories", "versions": [{"status": "affected", "version": ">= 6.0.0-rc.1, < 6.0.1"}, {"status": "affected", "version": ">= 5.0.0-rc.1, < 5.5.6"}, {"status": "affected", "version": ">= 3.0.0-beta1, < 4.7.19"}]}], "references": [{"url": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-7x2j-2674-fj95", "name": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-7x2j-2674-fj95", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/nextcloud/calendar/pull/7537", "name": "https://github.com/nextcloud/calendar/pull/7537", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/nextcloud/calendar/commit/f41650c3681fc4a4130eb883f5c0899c011326b3", "name": "https://github.com/nextcloud/calendar/commit/f41650c3681fc4a4130eb883f5c0899c011326b3", "tags": ["x_refsource_MISC"]}, {"url": "https://hackerone.com/reports/3275810", "name": "https://hackerone.com/reports/3275810", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Nextcloud Calendar is a calendar app for Nextcloud. Prior to 4.7.19, 5.5.6, and 6.0.1, the calendar app allowed blindly booking appointments with a squential ID without known the appointment token. This vulnerability is fixed in 4.7.19, 5.5.6, and 6.0.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-639", "description": "CWE-639: Authorization Bypass Through User-Controlled Key"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-12-05T16:49:46.553Z"}}}, "cveMetadata": {"cveId": "CVE-2025-66546", "state": "PUBLISHED", "dateUpdated": "2025-12-05T18:32:44.271Z", "dateReserved": "2025-12-04T15:52:26.549Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2025-12-05T16:49:46.553Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "security-advisories", "vendor": "nextcloud", "versions": [{"status": "affected", "version": ">= 6.0.0-rc.1, < 6.0.1"}, {"status": "affected", "version": ">= 5.0.0-rc.1, < 5.5.6"}, {"status": "affected", "version": ">= 3.0.0-beta1, < 4.7.19"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:nextcloud:calendar:*:*:*:*:*:*:*:*", "matchCriteriaId": "84E1FFC4-516D-4680-9F67-E66C1FAE5E0B", "versionEndExcluding": "4.7.19", "versionStartIncluding": "4.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:nextcloud:calendar:*:*:*:*:*:*:*:*", "matchCriteriaId": "3E716F13-981B-49BA-98FF-3B52C9962EA2", "versionEndExcluding": "5.5.6", "versionStartIncluding": "5.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:nextcloud:calendar:6.0.0:-:*:*:*:*:*:*", "matchCriteriaId": "5FEEB806-FB4C-42B4-BE4E-297AB95A854F", "vulnerable": true}, {"criteria": "cpe:2.3:a:nextcloud:calendar:6.0.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "B1A878DF-8A9B-4987-8E2C-6873CA2C8427", "vulnerable": true}, {"criteria": "cpe:2.3:a:nextcloud:calendar:6.0.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "9B9884CA-4E88-4AB3-BA37-FAF9E845F04E", "vulnerable": true}, {"criteria": "cpe:2.3:a:nextcloud:calendar:6.0.0:rc3:*:*:*:*:*:*", "matchCriteriaId": "032400B7-AE78-467F-81CC-83164AC29796", "vulnerable": true}, {"criteria": "cpe:2.3:a:nextcloud:calendar:6.0.0:rc4:*:*:*:*:*:*", "matchCriteriaId": "D1A265F6-884F-44FF-B00F-CB5F7E704E0E", "vulnerable": true}, {"criteria": "cpe:2.3:a:nextcloud:calendar:6.0.0:rc5:*:*:*:*:*:*", "matchCriteriaId": "8249ACE0-0485-4485-B628-D157E57A91C0", "vulnerable": true}, {"criteria": "cpe:2.3:a:nextcloud:calendar:6.0.0:rc6:*:*:*:*:*:*", "matchCriteriaId": "508556C9-5596-42B5-AD76-8156A42FEED7", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Nextcloud Calendar is a calendar app for Nextcloud. Prior to 4.7.19, 5.5.6, and 6.0.1, the calendar app allowed blindly booking appointments with a squential ID without known the appointment token. This vulnerability is fixed in 4.7.19, 5.5.6, and 6.0.1."}, {"lang": "es", "value": "Nextcloud Calendar es una aplicaci\u00f3n de calendario para Nextcloud. Versiones anteriores a?4.7.19,?5.5.6 y?6.0.1, la aplicaci\u00f3n de calendario permit\u00eda reservar citas ciegamente con un ID secuencial sin conocer el token de la cita. Esta vulnerabilidad est\u00e1 corregida en?4.7.19,?5.5.6 y?6.0.1."}], "id": "CVE-2025-66546", "lastModified": "2026-10-18T14:10:00.110", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 3.3, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-66546", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-12-05T18:32:11.684776Z", "version": "2.0.3"}}]}, "published": "2025-12-05T17:16:05.163", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/nextcloud/calendar/commit/f41650c3681fc4a4130eb883f5c0899c011326b3"}, {"source": "security-advisories@github.com", "tags": ["Issue Tracking"], "url": "https://github.com/nextcloud/calendar/pull/7537"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-7x2j-2674-fj95"}, {"source": "security-advisories@github.com", "tags": ["Issue Tracking", "Vendor Advisory"], "url": "https://hackerone.com/reports/3275810"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-639"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"created": "2025-12-09T10:05:54.192073+00:00", "updated": "2025-12-09T10:05:54.192108+00:00", "vendors": ["nextcloud", "nextcloud$PRODUCT$calendar"]}