Nextcloud Tables CVE-2025-66513

Requires an authenticated Nextcloud user session with access to the Tables app; the vulnerable share-listing API endpoints (getShare / indexViewShares / indexTableShares in Api1Controller) lacked the RequirePermission(MANAGE) authorization check in versions prior to 0.8.9, 0.9.6 and 1.0.1, so any user - not only those with manage rights - could read sharing metadata. Exploitable against default configurations of affected versions with no special settings. Limiting factors: an authenticated account is needed, disclosure is restricted to table-sharing metadata (target users/groups and their permissions, referenced by numeric table ID) rather than table contents, and there is no integrity or availability impact.

This is a genuinely low-to-moderate priority issue despite a medium CVSS of 5.3. The signals are consistent and point to minor risk: CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) yields only a Low confidentiality impact with no integrity or availability effect, EPSS is 0.02% (4th percentile - essentially negligible predicted exploitation), there is no CISA KEV listing, and no public exploit code was identified (the HackerOne report 3334165 is a vendor advisory reference, not a published POC). The one point of tension is privileges: the NVD vector asserts PR:N (unauthenticated), yet the description states the leaked data 'was not limited to privileged users' and the fix adds RequirePermission(MANAGE) checks - both of which imply the caller is still an authenticated Nextcloud user who merely lacks management rights. CVSS vector says network/unauthenticated, but the description and patch imply authenticated-but-under-privileged access - verify PR with vendor; this likely should be PR:L. Net effect: a low-impact authorization/information-disclosure flaw leaking table-sharing metadata (which users/groups a table is shared with and their permissions), not table contents. Patch is available and should be applied on normal cadence; this is not an emergency.

An authenticated Nextcloud user with only basic (non-management) access to a Tables table calls the share-listing API endpoints and retrieves the list of users and groups the table/view is shared with along with their permission levels, information that should be restricted to users with manage rights. No public exploit code was identified; exploitation is a simple authenticated API request requiring no special tooling.