CVE-2025-59716 Information disclosure in n/a
Unauthenticated attackers can enumerate valid pending guest users by observing differential responses from the registration endpoint.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-59716?
CVE-2025-59716 is a medium-severity vulnerability in n/a, published on 5 Nov 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
ownCloud Guests before 0.12.5 allows unauthenticated user enumeration via the /apps/guests/register/{email}/{token} endpoint. Because of insufficient validation of the supplied token in showPasswordForm, the server responds differently when an e-mail address corresponds to a valid pending guest user rather than a non-existent user.
Which versions are affected by CVE-2025-59716?
It affects 1 product.
Products include Owncloud Guests.
How do I fix CVE-2025-59716?
No fix has been published for CVE-2025-59716 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-59716 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-59716 exists.
Public exploit code: 1 Nuclei template.
Sources
Also known as GHSA-967j-jc6x-3jm4.