CVE-2025-66551
📋 TL;DR
This vulnerability in Nextcloud Tables allows authenticated malicious users to move columns they created into other users' tables without authorization. This affects all Nextcloud instances running Tables versions before 0.8.6 or 0.9.3. The attack requires a valid user account but no special privileges.
💻 Affected Systems
- Nextcloud Tables
📦 What is this software?
Tables by Nextcloud
Tables by Nextcloud
⚠️ Risk & Real-World Impact
Worst Case
Malicious users could manipulate or corrupt other users' table structures, potentially causing data integrity issues or disrupting legitimate users' workflows.
Likely Case
Unauthorized modification of table schemas leading to confusion, data display issues, or minor workflow disruption for affected users.
If Mitigated
With proper access controls and monitoring, impact is limited to isolated table structure changes that can be audited and reverted.
🎯 Exploit Status
Exploitation requires authenticated access but no special privileges. The vulnerability is straightforward to exploit once identified.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.8.6 or 0.9.3
Vendor Advisory: https://github.com/nextcloud/security-advisories/security/advisories/GHSA-w787-vwqp-8wr7
Restart Required: No
Instructions:
1. Update Nextcloud Tables app to version 0.8.6 or 0.9.3 via Nextcloud app store or manual installation. 2. No server restart required. 3. Verify update completed successfully.
🔧 Temporary Workarounds
Disable Tables App
linuxTemporarily disable the Tables app to prevent exploitation while planning update.
occ app:disable tables
🧯 If You Can't Patch
- Restrict user account creation and monitor existing user activities
- Implement additional table access logging and alert on suspicious column modifications
🔍 How to Verify
Check if Vulnerable:
Check Tables app version in Nextcloud admin settings or run: occ app:list | grep tablesCheck Version:
occ app:list | grep tablesVerify Fix Applied:
Verify Tables version is 0.8.6 or higher (or 0.9.3 or higher) in app settings📡 Detection & Monitoring
Log Indicators:
- Unusual column modification events in Nextcloud logs
- Multiple column move operations from single user
Network Indicators:
- API calls to column movement endpoints from unexpected sources
SIEM Query:
source="nextcloud.log" AND "column" AND "move" AND user!="admin"