Medium severity4.5NVD Advisory· Published Dec 5, 2025· Updated Jun 17, 2026

CVE-2025-66510

Description

Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server prior to 31.0.10 and 32.0.1 and Nextcloud Enterprise Server prior to 28.0.14.11, 29.0.16.8, 30.0.17.3, and 31.0.10, contacts search allowed to retrieve personal data of other users (emails, names, identifiers) without proper access control. This allows an authenticated user to retrieve information about accounts that are not related or added as contacts.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

osv-coords2 versions
pkg:bitnami/nextcloud pkg:apk/chainguard/nextcloud-server-30-apache2-config
>= 31.0.0, < 31.0.10+ 1 more
- (no CPE)range: >= 31.0.0, < 31.0.10
- (no CPE)range: < 30.0.17-r0
Nextcloud/Server2 versions
cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:enterprise:*:*:*+ 1 more
- cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:enterprise:*:*:*range: >=28.0.0,<28.0.14.11
- cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:-:*:*:*range: >=31.0.0,<31.0.10
Nextcloud/Nextcloud Enterprise Serverllm-fuzzy
Range: <31.0.10, <32.0.1
Nextcloud/security-advisoriescpe-rescue
Range: >= 32.0.0beta1, < 32.0.1

Patches

Vulnerability mechanics

References

github.com/nextcloud/security-advisories/security/advisories/GHSA-495w-cqv6-wr59nvdPatchVendor Advisory
github.com/nextcloud/server/commit/e4866860cbf24a746eb8a125587262a4c8831c57nvdPatch
github.com/nextcloud/server/pull/55657nvdIssue Tracking

News mentions

No linked articles in our index yet.

cvss	0.293
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000