CVE-2025-66513: Nextcloud Tables Auth Bypass Vulnerability

CVE-2025-66513 Overview

CVE-2025-66513 is an information disclosure vulnerability in Nextcloud Tables, an application that lets users create custom tables with individual columns. Prior to versions 0.8.9, 0.9.6, and 1.0.1, the endpoint returning share metadata did not restrict access to privileged users. Any authenticated user could query which numeric table IDs were shared with which users or groups and view the associated permissions. The issue is tracked as CWE-639: Authorization Bypass Through User-Controlled Key and is fixed in the patched releases.

Critical Impact
Authenticated users could enumerate share metadata for tables belonging to other users, exposing table IDs, group and user assignments, and permission levels.

Affected Products

Nextcloud Tables versions prior to 0.8.9
Nextcloud Tables versions 0.9.0 through 0.9.5
Nextcloud Tables versions 1.0.0

Discovery Timeline

2025-12-05 - CVE-2025-66513 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-66513

Vulnerability Analysis

The flaw resides in the share retrieval logic of the Nextcloud Tables API, specifically in lib/Controller/Api1Controller.php. The controller method that returns a share object by numeric ID did not verify that the requesting user had privileged access to the underlying table before returning the share record. As a result, any authenticated Nextcloud user could iterate through share IDs and read metadata describing which table was shared, to which principals it was shared, and what permissions each principal held.

The vulnerability discloses confidentiality-relevant metadata only. It does not permit modifying tables, altering permissions, or reading row data. The scope is limited to share objects exposed through the Tables API endpoint.

Root Cause

The controller lacked an authorization check on the caller relative to the requested share. The share lookup was keyed only on the numeric share ID supplied by the client, which is the classic pattern described by CWE-639. Because the numeric IDs are sequential and predictable, an attacker could enumerate shares by incrementing the ID parameter.

Attack Vector

An attacker authenticated to the Nextcloud instance sends requests to the Tables share endpoint with sequential share IDs. The endpoint returns share metadata for tables the attacker has no legitimate access to. No user interaction and no elevated privileges are required beyond a standard authenticated session.

php

// Security patch in lib/Controller/Api1Controller.php
// The 403 "No permissions" response path was removed and the
// authorization outcome is now folded into a 404 "Not found/No permissions"
// response, indicating the server now consistently refuses to disclose
// share existence to unauthorized callers.

 * Get a share object
 *
 * @param int $shareId Share ID
- * @return DataResponse<Http::STATUS_OK, TablesShare, array{}>|DataResponse<Http::STATUS_FORBIDDEN|Http::STATUS_INTERNAL_SERVER_ERROR|Http::STATUS_NOT_FOUND, array{message: string}, array{}>
+ * @return DataResponse<Http::STATUS_OK, TablesShare, array{}>|DataResponse<Http::STATUS_INTERNAL_SERVER_ERROR|Http::STATUS_NOT_FOUND, array{message: string}, array{}>
 *
 * 200: Share returned
- * 403: No permissions
- * 404: Not found
+ * 404: Not found/No permissions
 */
#[NoAdminRequired]
#[NoCSRFRequired]

Source: nextcloud/tables commit b92b956

Detection Methods for CVE-2025-66513

Indicators of Compromise

Sequential GET requests to Tables share API endpoints from a single authenticated session, iterating numeric share IDs.
Access to Tables share endpoints by user accounts that own no tables and have not been granted shares.
Unusual volume of HTTP 200 responses from share retrieval endpoints followed by no subsequent table-data reads.

Detection Strategies

Review Nextcloud application logs and web server access logs for enumeration patterns against the Tables share API path.
Correlate the requesting user identity with the ownership of the accessed share IDs to surface out-of-scope access.
Alert on any authenticated user retrieving share metadata for more than a small threshold of distinct share IDs within a short window.

Monitoring Recommendations

Ingest Nextcloud audit logs into a centralized logging platform and retain them long enough to support retrospective hunts.
Add rules that flag 403-to-200 response transitions on the Tables share endpoint across the upgrade window.
Track the installed version of the Tables app across Nextcloud instances to confirm all deployments are on 0.8.9, 0.9.6, or 1.0.1 or later.

How to Mitigate CVE-2025-66513

Immediate Actions Required

Upgrade Nextcloud Tables to 0.8.9, 0.9.6, or 1.0.1 depending on the currently deployed branch.
Review the GitHub Security Advisory GHSA-2cwj-qp49-4xfw and confirm the fixed version is present in production.
Audit existing share configurations for any table where the share metadata is considered sensitive, and rotate or restructure shares if disclosure is unacceptable.

Patch Information

The fix is delivered in Nextcloud Tables 0.8.9, 0.9.6, and 1.0.1. It removes the 403 No permissions response branch and consistently returns 404 Not found/No permissions, ensuring the server does not disclose whether a share exists to an unauthorized caller. See the merged pull request #2148 and the HackerOne report #3334165 for additional context.

Workarounds

No official workaround is published; upgrading to a fixed version is the recommended remediation.
If patching must be delayed, restrict access to the Tables app to a smaller trusted user group via Nextcloud app group settings.
Monitor Tables share API usage and disable the app entirely for the affected user base until the upgrade is applied.

bash

# Upgrade Nextcloud Tables via occ to a fixed release
sudo -u www-data php occ app:update tables
sudo -u www-data php occ app:list | grep tables
# Confirm the installed version is 0.8.9, 0.9.6, or 1.0.1 (or later)