CVE-2025-66510
Nextcloud Server Contacts Search allowed users to retrieve contact information of other users beyond their contact list
Description
Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server prior to 31.0.10 and 32.0.1 and Nextcloud Enterprise Server prior to 28.0.14.11, 29.0.16.8, 30.0.17.3, and 31.0.10, contacts search allowed to retrieve personal data of other users (emails, names, identifiers) without proper access control. This allows an authenticated user to retrieve information about accounts that are not related or added as contacts.
No summary for this CVE yet.
CVSS Vector Breakdown
Exploitability
AV:NAttack VectorNetwork
AC:LAttack ComplexityLow
PR:HPrivileges RequiredHigh
UI:RUser InteractionRequired
Scope
S:UScopeUnchanged
Impact
C:HConfidentialityHigh
I:NIntegrityNone
A:NAvailabilityNone
Weaknesses
Affected Products
nextcloud
oss-project·DEaka nextcloud server
Nextcloud GmbH
commercial·DEaka nextcloud server, nextcloud calendar, nextcloud enterprise server
ООО «Ред Софт»
commercial·RUaka red soft
Exploitability
Official Patch Available
References
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-495w-cqv6-wr59
github.com
https://github.com/nextcloud/server/commit/e4866860cbf24a746eb8a125587262a4c8831c57
github.com
https://github.com/nextcloud/server/pull/55657
github.com
and 2 more references View all →
Unlock Complete Vulnerability Intelligence
Get the full picture for CVE-2025-66510 and every CVE in our database. Create a free account — no credit card required.
Create Free AccountPlain-language analysis
Impact assessment and exploitation scenario in plain English
Attack graph visualization
Interactive attack path and kill chain mapping
Exploit details & PoC links
ExploitDB, Metasploit, GitHub PoCs with direct links
Nuclei scanner templates
Ready-to-use vulnerability scanner templates
Full remediation guide
Patch instructions, workarounds, and compliance impact
Interactive AI chat
Ask questions about this vulnerability in natural language
Related vulnerabilities
Semantically similar CVEs and attack patterns
REST API & MCP access
Integrate vulnerability data into your workflows