CVE-2025-66546
LowCVSS 3.3Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
Nextcloud Calendar is a calendar app for Nextcloud. Prior to 4.7.19, 5.5.6, and 6.0.1, the calendar app allowed blindly booking appointments with a sequential ID without knowing the appointment token. This vulnerability is fixed in 4.7.19, 5.5.6, and 6.0.1.
Risk Assessment
An attacker could unauthorizedly book appointments in other users' calendars, potentially causing scheduling disruptions or abuse.
Recommendation
Update the Nextcloud Calendar app to version 4.7.19, 5.5.6, 6.0.1, or later.
Other vulnerabilities in Nextcloud Calendar
See all- CVE-2025-66550Medium
Nextcloud Calendar before versions 4.7.17 and 5.2.4 allows a malicious user to create a calendar event with a crafted attachment linking to a file download on the same Nextcloud server. The file is downloaded without the user confirming the action.
- CVE-2025-66511Medium
Nextcloud Calendar prior to 6.0.3 generates participant tokens for meeting proposals using a hash function, allowing an attacker to compute valid participant tokens. This allowed them to request details and submit dates in meeting proposals. The tokens are not purely randomly generated.
Original NVD description (English source)
Nextcloud Calendar is a calendar app for Nextcloud. Prior to 4.7.19, 5.5.6, and 6.0.1, the calendar app allowed blindly booking appointments with a squential ID without known the appointment token. This vulnerability is fixed in 4.7.19, 5.5.6, and 6.0.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS