Nextcloud Calendar vulnerabilities

Nextcloud Calendar before versions 4.7.17 and 5.2.4 allows a malicious user to create a calendar event with a crafted attachment linking to a file download on the same Nextcloud server. The file is downloaded without the user confirming the action.

Nextcloud Calendar is a calendar app for Nextcloud. Prior to 4.7.19, 5.5.6, and 6.0.1, the calendar app allowed blindly booking appointments with a sequential ID without knowing the appointment token. This vulnerability is fixed in 4.7.19, 5.5.6, and 6.0.1.

Nextcloud Calendar prior to 6.0.3 generates participant tokens for meeting proposals using a hash function, allowing an attacker to compute valid participant tokens. This allowed them to request details and submit dates in meeting proposals. The tokens are not purely randomly generated.