CVE-2025-66553 Nextcloud Tables app allowed users to view columns metadata information of any table

What is CVE-2025-66553?

CVE-2025-66553 is a medium-severity missing authorization vulnerability in nextcloud security-advisories, published on 5 Dec 2025. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Nextcloud Tables allows you to create your own tables with individual columns. Prior to 0.8.7 and 0.9.4, authenticated users were able to view meta data of columns in other tables of the Tables app by modifying the numeric ID in a request. This vulnerability is fixed in 0.8.7 and 0.9.4.

Weakness: CWE-639

Which versions are affected by CVE-2025-66553?

It affects 1 product.

Products include Nextcloud Tables.

How do I fix CVE-2025-66553?

No fix has been published for CVE-2025-66553 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2025-66553 being exploited?

There is no known exploitation of CVE-2025-66553 in the wild and no public exploit code.

Other vulnerabilities in nextcloud security-advisories

• CVE-2026-45545 Nextcloud: SQL Injection in Column Type Parameter Allows Arbitrary SQL Execution High 8.2
• CVE-2026-45722 Nextcloud: Tables app allows limited SQLi in ORDER BY with malicious sort order argument for Table Views High 7.1
• CVE-2025-66551 Nextcloud Tables is missing an ownership check which allows moving columns into tables of other users Medium 6.3
• CVE-2024-52511 Nextcloud Tables has an Authorization Bypass Through User-Controlled Key in Tables Medium 6.3
• CVE-2026-45544 Nextcloud: Information Disclosure of view filter metdata via Broken Sensitive Data Masking in ViewService Medium 4.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-p53h-6294-crjw.