CVE-2025-66553
📋 TL;DR
CVE-2025-66553 is an authorization bypass vulnerability in Nextcloud Tables where authenticated users can view metadata of columns in other tables by manipulating numeric IDs in requests. This affects Nextcloud instances with the Tables app installed, allowing unauthorized access to table structure information. The vulnerability impacts authenticated users who have access to at least one table.
💻 Affected Systems
- Nextcloud Tables
📦 What is this software?
Tables by Nextcloud
Tables by Nextcloud
⚠️ Risk & Real-World Impact
Worst Case
Attackers could map all table structures in the system, potentially identifying sensitive data columns and planning further attacks based on discovered metadata patterns.
Likely Case
Unauthorized users viewing metadata of tables they shouldn't access, potentially revealing column names, data types, and relationships that could inform social engineering or targeted attacks.
If Mitigated
Limited exposure of non-sensitive metadata with no direct data access, though still violates authorization boundaries.
🎯 Exploit Status
Exploitation requires authenticated access and involves modifying numeric IDs in API requests to access unauthorized table metadata.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.8.7 or 0.9.4
Vendor Advisory: https://github.com/nextcloud/security-advisories/security/advisories/GHSA-p53h-6294-crjw
Restart Required: No
Instructions:
1. Update Nextcloud Tables app to version 0.8.7 or 0.9.4 via Nextcloud app store or manual installation. 2. Verify the update completed successfully. 3. No server restart required.
🔧 Temporary Workarounds
Disable Tables App
linuxTemporarily disable the Tables app if not essential
occ app:disable tables
Restrict User Permissions
allLimit which users can access the Tables app
🧯 If You Can't Patch
- Implement strict access controls and monitor for unusual table metadata access patterns
- Use network segmentation to isolate Nextcloud instances and limit exposure
🔍 How to Verify
Check if Vulnerable:
Check Tables app version in Nextcloud admin settings or run: occ app:list | grep tablesCheck Version:
occ app:list | grep tablesVerify Fix Applied:
Confirm Tables app version is 0.8.7 or higher (or 0.9.4 or higher) and test that ID manipulation no longer returns unauthorized metadata📡 Detection & Monitoring
Log Indicators:
- Unusual sequence of column metadata requests
- Requests with rapidly changing numeric IDs in table-related endpoints
Network Indicators:
- Patterns of sequential ID requests to Tables API endpoints
SIEM Query:
source="nextcloud.log" AND "tables" AND ("column" OR "metadata") AND status=200 | stats count by user, request_uri