CVE-2025-66546 Nextcloud Calendar app allowed booking appointments without the generated token
Attackers can book appointments without valid tokens by guessing sequential IDs, allowing unauthorized data modification in Nextcloud Calendar.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-66546?
CVE-2025-66546 is a low-severity missing authorization vulnerability in nextcloud security-advisories, published on 5 Dec 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Nextcloud Calendar is a calendar app for Nextcloud. Prior to 4.7.19, 5.5.6, and 6.0.1, the calendar app allowed blindly booking appointments with a squential ID without known the appointment token. This vulnerability is fixed in 4.7.19, 5.5.6, and 6.0.1.
Weakness: CWE-639
Which versions are affected by CVE-2025-66546?
It affects 1 product.
Products include Nextcloud Calendar.
How do I fix CVE-2025-66546?
No fix has been published for CVE-2025-66546 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2025-66546 being exploited?
There is no known exploitation of CVE-2025-66546 in the wild and no public exploit code.
Other vulnerabilities in nextcloud security-advisories
- CVE-2025-66550 Nextcloud Calendar attachments of local files are offered to downloaded
- CVE-2022-24838 Command Injection in Appointment Emails for Nextcloud Calendar
- CVE-2025-66511 Nextcloud Calendar app used predictable proposal participant tokens
- CVE-2018-3763 Cross-site scripting in Nextcloud Calendar application
- CVE-2024-37316 Nextcloud Calendar's event create can create attachments that link to other websites
Sources
Also known as GHSA-7x2j-2674-fj95.