CVE-2025-66511
MediumCVSS 4.8Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
Nextcloud Calendar prior to 6.0.3 generates participant tokens for meeting proposals using a hash function, allowing an attacker to compute valid participant tokens. This allowed them to request details and submit dates in meeting proposals. The tokens are not purely randomly generated.
Risk Assessment
An attacker can access meeting proposal details and modify dates without authorization, potentially leading to information disclosure or disruption of scheduling within the organization.
Recommendation
Update Nextcloud Calendar to version 6.0.3 or later to fix the participant token generation mechanism.
Other vulnerabilities in Nextcloud Calendar
See all- CVE-2025-66550Medium
Nextcloud Calendar before versions 4.7.17 and 5.2.4 allows a malicious user to create a calendar event with a crafted attachment linking to a file download on the same Nextcloud server. The file is downloaded without the user confirming the action.
- CVE-2025-66546Low
Nextcloud Calendar is a calendar app for Nextcloud. Prior to 4.7.19, 5.5.6, and 6.0.1, the calendar app allowed blindly booking appointments with a sequential ID without knowing the appointment token. This vulnerability is fixed in 4.7.19, 5.5.6, and 6.0.1.
Original NVD description (English source)
Nextcloud Calendar is a calendar app for Nextcloud. Prior to 6.0.3, the Calendar app generates participant tokens for meeting proposals using a hash function, allowing an attacker to compute valid participant tokens, which allowed them to request details and submit dates in meeting proposals. The tokens are not purely random generated. This vulnerability is fixed in 6.0.3.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS