Medium severity5.4NVD Advisory· Published Dec 5, 2025· Updated Sep 25, 2026

CVE-2025-66557

Description

Nextcloud Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. Prior to 1.14.6 and 1.15.2, a bug in the permission logic allowed users with "Can share" permission to modify the permissions of other recipients. This vulnerability is fixed in 1.14.6 and 1.15.2.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Nextcloud/Deckllm-fuzzy2 versions
<1.14.6 and <1.15.2+ 1 more
- (no CPE)range: <1.14.6 and <1.15.2
- cpe:2.3:a:nextcloud:deck:*:*:*:*:*:*:*:*range: >=1.14.0,<1.14.6
Nextcloud/security-advisoriescpe-rescue
Range: >= 1.15.0-beta.1, < 1.15.2

Patches

Vulnerability mechanics

References

github.com/nextcloud/deck/commit/f1da8b30a455f02373d44154da04494c949a95aenvdPatch
github.com/nextcloud/deck/pull/7131nvdIssue TrackingPatch
github.com/nextcloud/security-advisories/security/advisories/GHSA-wwr8-hx9g-rjvvnvdPatchVendor Advisory
hackerone.com/reports/3247499nvdIssue TrackingVendor Advisory

News mentions

No linked articles in our index yet.

cvss	0.351
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000