IP-DB.com
Türkçe English Deutsch Español
Giriş API Anahtarı Al
4.5Orta

CVE-2025-66510Nextcloud Server Contacts Search allowed users to retrieve contact information of other users beyond their contact list

nextcloud security-advisories Yayım: (11 ay önce)

Açıklama

Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server prior to 31.0.10 and 32.0.1 and Nextcloud Enterprise Server prior to 28.0.14.11, 29.0.16.8, 30.0.17.3, and 31.0.10, contacts search allowed to retrieve personal data of other users (emails, names, identifiers) without proper access control. This allows an authenticated user to retrieve information about accounts that are not related or added as contacts.

Zayıflık türü (CWE): CWE-359

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

ÜreticiÜrünSürümler
nextcloud nextcloud server 28.0.0 – < 28.0.14.11
nextcloud security-advisories >= 32.0.0beta1, < 32.0.1, < 31.0.10

Kaynaklar ve yamalar

CPE eşleşmeleri (NVD) (6)
  • cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:enterprise:*:*:* ≥ 28.0.0 < 28.0.14.11
  • cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:enterprise:*:*:* ≥ 29.0.0 < 29.0.16.8
  • cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:enterprise:*:*:* ≥ 30.0.0 < 30.0.17.3
  • cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:-:*:*:* ≥ 31.0.0 < 31.0.10
  • cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:enterprise:*:*:* ≥ 31.0.0 < 31.0.10
  • cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:-:*:*:* ≥ 32.0.0 < 32.0.1

Aynı üründe son açıklar — Nextcloud

7.5Yüksek
CVE-2026-77167
Nextcloud server

Abusing the federated share endpoint, an attacker can write arbitrary rows into the oc_share_external database table. These rows persist indefinitely — there is no automatic cleanup mechanism. Three distinct denial-of-service conditions follow from this write…

5.3Orta
CVE-2026-77172
Nextcloud Server

App passwords were allowed to bypass password confirmation on sensitive endpoints.

4.3Orta
CVE-2026-82984
Nextcloud Server

When a team was configured as "visible to everyone", the web UI correctly blocked non-members from viewing the team ("You are not a member of ..."), but the resources API endpoint could still be called directly, allowing any authenticated non-member to enumer…

6.5Orta
CVE-2026-77165
Nextcloud Server

File owners were unable to unlock TYPE_TOKEN locks placed by other users, leaving files permanently locked with no recovery path outside of the database.

3.1Düşük
CVE-2026-68493
Nextcloud Server

After guessing a 62^15 complex unique identifier, a malicious logged in user was able to retrieve a list of memberships for a circle they are not a member of.

6.2Orta
CVE-2026-77164
Nextcloud Server

Circles' remote-instance signature verification fetches the attacker-supplied keyId URL before trust in the remote instance is established, and explicitly allows local/private addresses for this request, bypassing Nextcloud's core SSRF protections. The public…