{"id":"CVE-2025-66546","aliases":["EUVD-2025-201445","GHSA-7x2j-2674-fj95"],"status":"published","title":"Nextcloud Calendar app allowed booking appointments without the generated token","description":"Nextcloud Calendar is a calendar app for Nextcloud. Prior to 4.7.19, 5.5.6, and 6.0.1, the calendar app allowed blindly booking appointments with a squential ID without known the appointment token. This vulnerability is fixed in 4.7.19, 5.5.6, and 6.0.1.","severity":{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00149,"percentile":0.04067,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-639"],"published":"2025-12-05T16:49:46Z","modified":"2026-10-28T02:30:39Z","products":[{"vendor":"kiteworks","product":"security-advisories"},{"vendor":"nextcloud","product":"calendar"},{"vendor":"nextcloud","product":"security-advisories"}],"references":[{"url":"https://github.com/nextcloud/security-advisories/security/advisories/GHSA-7x2j-2674-fj95","tags":["x_refsource_CONFIRM","Patch","Vendor Advisory","advisory"]},{"url":"https://github.com/nextcloud/calendar/pull/7537","tags":["x_refsource_MISC","Issue Tracking","fix"]},{"url":"https://github.com/nextcloud/calendar/commit/f41650c3681fc4a4130eb883f5c0899c011326b3","tags":["x_refsource_MISC","Patch","fix"]},{"url":"https://hackerone.com/reports/3275810","tags":["x_refsource_MISC","Issue Tracking","Vendor Advisory","web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66546.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-66546","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-66546","title":"Nextcloud Calendar app allowed booking appointments without the generated token","description":"Nextcloud Calendar is a calendar app for Nextcloud. Prior to 4.7.19, 5.5.6, and 6.0.1, the calendar app allowed blindly booking appointments with a squential ID without known the appointment token. This vulnerability is fixed in 4.7.19, 5.5.6, and 6.0.1.","status":"published","published":"2025-12-05T16:49:46.553Z","modified":"2025-12-05T18:32:44.271Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"cna"}],"cwes":["CWE-639"],"updated_at":"2026-11-02T14:32:53.157279Z"}],"euvd":[{"id":"EUVD-2025-201445","description":"Nextcloud Calendar is a calendar app for Nextcloud. Prior to 4.7.19, 5.5.6, and 6.0.1, the calendar app allowed blindly booking appointments with a squential ID without known the appointment token. This vulnerability is fixed in 4.7.19, 5.5.6, and 6.0.1.","status":"published","published":"2025-12-05T16:49:46Z","modified":"2025-12-05T18:32:44Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T19:49:09.437744Z"}],"nvd":[{"id":"CVE-2025-66546","description":"Nextcloud Calendar is a calendar app for Nextcloud. Prior to 4.7.19, 5.5.6, and 6.0.1, the calendar app allowed blindly booking appointments with a squential ID without known the appointment token. This vulnerability is fixed in 4.7.19, 5.5.6, and 6.0.1.","status":"published","published":"2025-12-05T17:16:05.163Z","modified":"2026-10-18T14:10:00.11Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"secondary"}],"cwes":["CWE-639"],"updated_at":"2026-11-02T14:11:49.093461Z"}],"osv":[{"id":"CVE-2025-66546","title":"Nextcloud Calendar app allowed booking appointments without the generated token","description":"Nextcloud Calendar is a calendar app for Nextcloud. Prior to 4.7.19, 5.5.6, and 6.0.1, the calendar app allowed blindly booking appointments with a squential ID without known the appointment token. This vulnerability is fixed in 4.7.19, 5.5.6, and 6.0.1.","status":"published","published":"2025-12-05T16:49:46.553Z","modified":"2026-10-28T02:30:39.849603911Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-639"],"updated_at":"2026-11-02T15:44:52.202386Z"}]}}