CVE-2025-66551

Nextcloud Tables is missing an ownership check which allows moving columns into tables of other users

6.3 Medium

Nextcloud Tables allows you to create your own tables with individual columns. Prior to 0.8.6 and 0.9.3, a malicious user was able to create their own table and then move a column to a victims table. This vulnerability is fixed in 0.8.6 and 0.9.3.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: Required

What an attacker can affect

Confidentiality: None
Integrity: High
Availability: Low

Exploit likelihood

0.27%Up 0.2 points since Dec 6, 2025

What each source reports

CVE List Score used 6.3

Nextcloud Tables is missing an ownership check which allows moving columns into tables of other users

Record: CVE-2025-66551
CVSS 3.1: 6.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:L
Weakness: CWE-639
Updated: 2026-11-02

EUVDEUVD-2025-201440 6.3

Record: EUVD-2025-201440
CVSS 3.1: 6.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:L
Updated: 2026-11-02

NVD 6.3

Record: CVE-2025-66551
CVSS 3.1: 6.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:L
CVSS 3.1: 4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Weakness: CWE-639
Updated: 2026-11-02

OSV 6.3

Nextcloud Tables is missing an ownership check which allows moving columns into tables of other users

Record: CVE-2025-66551
CVSS 3.1: 6.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:L
Weakness: CWE-639
Updated: 2026-11-02

Affected products

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-66551 is a medium vulnerability (CVSS 6.3) in Nextcloud Tables, published December 5, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.27%, the 19th percentile. No source names a fixed version.