CVE-2025-66557
📋 TL;DR
This vulnerability in Nextcloud Deck allows users with 'Can share' permission to modify permissions of other recipients, potentially escalating privileges within shared boards. It affects all Nextcloud instances running Deck versions before 1.14.6 or 1.15.2. The issue stems from improper access control in permission logic.
💻 Affected Systems
- Nextcloud Deck
📦 What is this software?
Deck by Nextcloud
Deck by Nextcloud
⚠️ Risk & Real-World Impact
Worst Case
An authenticated user with share permissions could modify permissions of other users, potentially gaining administrative control over shared boards, manipulating data, or disrupting team workflows.
Likely Case
Users with share permissions could unintentionally or maliciously alter permissions of other team members, causing confusion, data access issues, or minor workflow disruptions.
If Mitigated
With proper user access controls and monitoring, impact is limited to minor permission changes that can be quickly detected and reverted.
🎯 Exploit Status
Exploitation requires authenticated access with 'Can share' permissions. The vulnerability is well-documented in security advisories.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.14.6 or 1.15.2
Vendor Advisory: https://github.com/nextcloud/security-advisories/security/advisories/GHSA-wwr8-hx9g-rjvv
Restart Required: No
Instructions:
1. Update Nextcloud Deck to version 1.14.6 (stable) or 1.15.2 (beta). 2. Use Nextcloud's built-in updater or manually update via app management. 3. No server restart required, but clear caches if issues persist.
🔧 Temporary Workarounds
Temporary permission restriction
allTemporarily remove 'Can share' permissions from users until patching is complete
Use Nextcloud admin interface to modify user permissions on Deck boards
🧯 If You Can't Patch
- Restrict 'Can share' permissions to trusted administrators only
- Implement enhanced monitoring of permission changes in Deck activity logs
🔍 How to Verify
Check if Vulnerable:
Check Nextcloud Deck version in Nextcloud admin interface under Apps > DeckCheck Version:
Check via Nextcloud web interface: Settings > Apps > Deck, or check nextcloud/config/config.php for app versionVerify Fix Applied:
Confirm Deck version is 1.14.6 or higher (stable) or 1.15.2 or higher (beta)📡 Detection & Monitoring
Log Indicators:
- Unusual permission modification events in Nextcloud Deck logs
- Multiple permission changes from single user in short timeframe
Network Indicators:
- POST requests to Deck API endpoints modifying permissions
SIEM Query:
source="nextcloud.log" AND "deck" AND "permission" AND ("modified" OR "changed")