CVE-2025-66513
📋 TL;DR
Nextcloud Tables had an authorization bypass vulnerability where unprivileged users could view which tables were shared with which groups/users and their permissions. This affects Nextcloud instances with the Tables app installed before versions 0.8.9, 0.9.6, or 1.0.1.
💻 Affected Systems
- Nextcloud Tables
📦 What is this software?
Tables by Nextcloud
Tables by Nextcloud
Tables by Nextcloud
⚠️ Risk & Real-World Impact
Worst Case
Unauthorized users could map all table sharing relationships across the instance, potentially identifying sensitive data repositories and their access controls.
Likely Case
Internal users could discover tables they shouldn't have access to, leading to information disclosure about organizational data structures.
If Mitigated
With proper access controls and monitoring, impact is limited to metadata exposure rather than actual data content.
🎯 Exploit Status
Exploitation requires authenticated access but minimal technical skill to query the vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.8.9, 0.9.6, or 1.0.1
Vendor Advisory: https://github.com/nextcloud/security-advisories/security/advisories/GHSA-2cwj-qp49-4xfw
Restart Required: No
Instructions:
1. Update Nextcloud Tables app via Nextcloud app store or manual installation. 2. For version 0.8.x: update to 0.8.9. 3. For version 0.9.x: update to 0.9.6. 4. For version 1.0.x: update to 1.0.1.
🔧 Temporary Workarounds
Disable Tables App
linuxTemporarily disable the Tables app if immediate patching isn't possible
occ app:disable tables
🧯 If You Can't Patch
- Restrict user access to only trusted individuals who need table functionality
- Implement additional monitoring for unusual table access patterns
🔍 How to Verify
Check if Vulnerable:
Check Tables app version in Nextcloud admin settings or run: occ app:list | grep tablesCheck Version:
occ app:list | grep tablesVerify Fix Applied:
Verify Tables app version is 0.8.9, 0.9.6, or 1.0.1 or higher📡 Detection & Monitoring
Log Indicators:
- Unusual volume of requests to table sharing/API endpoints
- Access patterns from users who shouldn't have table visibility
Network Indicators:
- Repeated API calls to /apps/tables/api endpoints from non-admin users
SIEM Query:
source="nextcloud" AND (uri_path="/apps/tables/api/*" OR app="tables") | stats count by user