CVE-2025-66511 Nextcloud Calendar app used predictable proposal participant tokens
Attackers can predict meeting proposal tokens to view details and submit dates in Nextcloud Calendar.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-66511?
CVE-2025-66511 is a medium-severity vulnerability in nextcloud security-advisories, published on 5 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Nextcloud Calendar is a calendar app for Nextcloud. Prior to 6.0.3, the Calendar app generates participant tokens for meeting proposals using a hash function, allowing an attacker to compute valid participant tokens, which allowed them to request details and submit dates in meeting proposals. The tokens are not purely random generated. This vulnerability is fixed in 6.0.3.
Weakness: CWE-330
Which versions are affected by CVE-2025-66511?
It affects 1 product.
Products include Nextcloud Calendar.
How do I fix CVE-2025-66511?
No fix has been published for CVE-2025-66511 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-66511 being exploited?
There is no known exploitation of CVE-2025-66511 in the wild and no public exploit code.
Other vulnerabilities in nextcloud security-advisories
- CVE-2025-66550 Nextcloud Calendar attachments of local files are offered to downloaded
- CVE-2022-24838 Command Injection in Appointment Emails for Nextcloud Calendar
- CVE-2018-3763 Cross-site scripting in Nextcloud Calendar application
- CVE-2024-37316 Nextcloud Calendar's event create can create attachments that link to other websites
- CVE-2026-45286 Nextcloud: Calendar app leaked user identifiers via attendee suggestion endpoint
Sources
Also known as GHSA-whm3-vv55-gf27.