Unrated severityNVD Advisory· Published Dec 5, 2025· Updated Dec 8, 2025
Nextcloud Deck app allowed user with "Can share" permission to modify permissions of other non-owners
CVE-2025-66557
Description
Nextcloud Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. Prior to 1.14.6 and 1.15.2, a bug in the permission logic allowed users with "Can share" permission to modify the permissions of other recipients. This vulnerability is fixed in 1.14.6 and 1.15.2.
Affected products
2- nextcloud/security-advisoriesv5Range: >= 1.15.0-beta.1, < 1.15.2
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
4- github.com/nextcloud/deck/commit/f1da8b30a455f02373d44154da04494c949a95aemitrex_refsource_MISC
- github.com/nextcloud/deck/pull/7131mitrex_refsource_MISC
- github.com/nextcloud/security-advisories/security/advisories/GHSA-wwr8-hx9g-rjvvmitrex_refsource_CONFIRM
- hackerone.com/reports/3247499mitrex_refsource_MISC
News mentions
0No linked articles in our index yet.