Vulnerability Description
Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server prior to 31.0.10 and 32.0.1 and Nextcloud Enterprise Server prior to 28.0.14.11, 29.0.16.8, 30.0.17.3, and 31.0.10, contacts search allowed to retrieve personal data of other users (emails, names, identifiers) without proper access control. This allows an authenticated user to retrieve information about accounts that are not related or added as contacts.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Nextcloud | Nextcloud Server | >= 28.0.0, < 28.0.14.11 |
Related Weaknesses (CWE)
References
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-495w-cPatchVendor Advisory
- https://github.com/nextcloud/server/commit/e4866860cbf24a746eb8a125587262a4c8831Patch
- https://github.com/nextcloud/server/pull/55657Issue Tracking
FAQ
What is CVE-2025-66510?
CVE-2025-66510 is a vulnerability with a CVSS score of 4.5 (MEDIUM). Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server prior to 31.0.10 and 32.0.1 and Nextcloud Enterprise Server prior to 28.0.14.11, 29.0.16.8, 30.0.17.3, and 31.0.10, contact...
How severe is CVE-2025-66510?
CVE-2025-66510 has been rated MEDIUM with a CVSS base score of 4.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-66510?
Check the references section above for vendor advisories and patch information. Affected products include: Nextcloud Nextcloud Server.