CVE-2025-66510: Nextcloud Server Information Disclosure

CVE-2025-66510 Overview

CVE-2025-66510 is an information disclosure vulnerability in Nextcloud Server and Nextcloud Enterprise Server. The contacts search functionality exposes personal data of other users, including emails, names, and identifiers, without enforcing proper access control. An authenticated user can retrieve information about accounts that are neither related to nor added as contacts. The issue is tracked under CWE-359: Exposure of Private Personal Information to an Unauthorized Actor.

Critical Impact
Authenticated users can enumerate account details of unrelated users on the same Nextcloud instance, enabling reconnaissance and targeted phishing against organization members.

Affected Products

Nextcloud Server prior to 31.0.10 and 32.0.1
Nextcloud Enterprise Server 28.x prior to 28.0.14.11, 29.x prior to 29.0.16.8, 30.x prior to 30.0.17.3
Nextcloud Enterprise Server 31.x prior to 31.0.10

Discovery Timeline

2025-12-05 - CVE-2025-66510 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-66510

Vulnerability Analysis

The vulnerability resides in the contacts search feature of the Nextcloud dav app. When an authenticated user queries the contacts search endpoint, the backend returns matching records from the system address book without filtering results against the requester's authorized contact scope. As a result, personal data belonging to unrelated accounts is exposed.

Exposed attributes include email addresses, display names, and internal user identifiers. This data is sufficient to enumerate the full user directory of a Nextcloud instance, even when administrators intend to restrict cross-user visibility through group membership or share policies.

The fix, delivered in pull request #55657, introduces a new OCA\DAV\ConfigLexicon class and gates system address book exposure behind an explicit configuration option. Requests from users who are not permitted to see the full directory now receive filtered results.

Root Cause

The root cause is missing authorization enforcement in the contacts search handler. The code relied on authentication alone and did not verify whether the requester was allowed to view the queried records. Because search matched against the system address book, all provisioned users on the instance became discoverable to any authenticated account.

Attack Vector

Exploitation requires an authenticated Nextcloud session and network access to the server. An attacker with a low-value or newly provisioned account can issue contacts search queries against the DAV endpoint and harvest personal data for other users. No user interaction is required from the victims.

php

// Patch excerpt from apps/dav/composer/composer/autoload_classmap.php
     'OCA\\DAV\\Comments\\EntityCollection' => $baseDir . '/../lib/Comments/EntityCollection.php',
     'OCA\\DAV\\Comments\\EntityTypeCollection' => $baseDir . '/../lib/Comments/EntityTypeCollection.php',
     'OCA\\DAV\\Comments\\RootCollection' => $baseDir . '/../lib/Comments/RootCollection.php',
+    'OCA\\DAV\\ConfigLexicon' => $baseDir . '/../lib/ConfigLexicon.php',
     'OCA\\DAV\\Connector\\LegacyDAVACL' => $baseDir . '/../lib/Connector/LegacyDAVACL.php',
     'OCA\\DAV\\Connector\\LegacyPublicAuth' => $baseDir . '/../lib/Connector/LegacyPublicAuth.php',

Source: nextcloud/server commit e4866860

Detection Methods for CVE-2025-66510

Indicators of Compromise

Unusually high volumes of contacts search queries from a single authenticated account against DAV endpoints such as /remote.php/dav/addressbooks/.
Access log patterns showing a single user enumerating short search strings (a, b, c) to page through the system address book.
Newly created low-privilege accounts issuing contacts search requests shortly after provisioning.

Detection Strategies

Review Nextcloud web server access logs for repeated REPORT or PROPFIND requests targeting the addressbook endpoints from non-administrative accounts.
Correlate authentication events with DAV search volumes to identify accounts that behave inconsistently with normal user activity.
Compare the running Nextcloud version against fixed releases (31.0.10, 32.0.1, and the enterprise branches) to confirm exposure.

Monitoring Recommendations

Enable audit logging in Nextcloud and forward events to a central log platform for retention and query.
Alert on any single account performing more contacts searches per hour than an established baseline for typical users.
Monitor for account provisioning followed by directory enumeration within a short window.

How to Mitigate CVE-2025-66510

Immediate Actions Required

Upgrade to Nextcloud Server 31.0.10 or 32.0.1, or the corresponding fixed Enterprise Server release for your branch.
Audit recent contacts search activity from non-privileged accounts to identify potential prior enumeration.
Rotate or disable any low-trust accounts that show anomalous search activity pending investigation.

Patch Information

The fix is available in Nextcloud Server 31.0.10 and 32.0.1, and in Nextcloud Enterprise Server 28.0.14.11, 29.0.16.8, 30.0.17.3, and 31.0.10. Details are published in the GitHub Security Advisory GHSA-495w-cqv6-wr59 and implemented in commit e4866860.

Workarounds

Restrict account provisioning on the affected instance until the patch is applied to limit the attacker population.
Where feasible, disable the contacts app or contacts search integration for standard users pending upgrade.
Enforce network-level restrictions such as VPN or IP allowlisting to reduce the pool of authenticated users that can reach DAV endpoints.

bash

# Verify installed Nextcloud version and upgrade
sudo -u www-data php /var/www/nextcloud/occ status
sudo -u www-data php /var/www/nextcloud/updater/updater.phar
sudo -u www-data php /var/www/nextcloud/occ upgrade