CVE-2025-66553: Nextcloud Tables Information Disclosure

CVE-2025-66553 Overview

CVE-2025-66553 is an Insecure Direct Object Reference (IDOR) vulnerability in Nextcloud Tables, an application that allows users to create tables with individual columns. Authenticated users could view column metadata from tables they do not own by modifying the numeric ID in a request. The issue is tracked under CWE-639: Authorization Bypass Through User-Controlled Key. Nextcloud fixed the flaw in Tables versions 0.8.7 and 0.9.4.

Critical Impact
Any authenticated Nextcloud user can enumerate column metadata of tables belonging to other users by tampering with numeric identifiers in API requests, leading to unauthorized information disclosure.

Affected Products

Nextcloud Tables prior to 0.8.7
Nextcloud Tables 0.9.x prior to 0.9.4
Deployments of Nextcloud instances with the Tables app installed

Discovery Timeline

2025-12-05 - CVE-2025-66553 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-66553

Vulnerability Analysis

The vulnerability affects the Tables app's column lookup logic. When a user requested column information, the application accepted a numeric node ID without verifying that the requesting user had rights to that node. By incrementing or substituting the ID, an attacker could retrieve metadata for columns stored in tables owned by other users.

The exposure is limited to column metadata rather than row data, which keeps the confidentiality impact scoped. Integrity and availability are not affected, but the leaked schema information can support reconnaissance against sensitive tables such as HR, finance, or project tracking data.

Root Cause

The root cause is missing authorization enforcement in the data source selection path within the Tables app. The pre-patch code called findAllByTable($nodeId, null, $this->userId) with a null parameter that bypassed ownership filtering. Nextcloud addressed this by refactoring the method signature to always enforce the acting user context.

Attack Vector

Exploitation requires an authenticated low-privileged Nextcloud account and network access to the Tables API. The attacker iterates numeric node identifiers and inspects responses for column schema details belonging to other tenants. No user interaction is required.

php

// Patch excerpt — lib/Analytics/AnalyticsDatasource.php and lib/Api/V1Api.php
$rows = $this->rowService->findAllByView($nodeId, $this->userId, $limit, $offset);
} else {
    // if no nodeType is provided, the old table selection is used to not break anything
-   $columns = $this->columnService->findAllByTable($nodeId, null, $this->userId);
+   $columns = $this->columnService->findAllByTable($nodeId, $this->userId);
    $rows = $this->rowService->findAllByTable($nodeId, $this->userId, $limit, $offset);
}

Source: Nextcloud Tables commit e975f5b. The fix removes the null argument that previously disabled per-user scoping and simplifies the method so authorization is applied consistently.

Detection Methods for CVE-2025-66553

Indicators of Compromise

Nextcloud application logs showing a single authenticated user issuing sequential or scripted requests to Tables API endpoints with incrementing node IDs.
HTTP 200 responses to Tables column endpoints for node IDs that the user does not own in the oc_tables_* database tables.
Unusual API query volume from standard user accounts targeting the /apps/tables/ route namespace.

Detection Strategies

Correlate Nextcloud audit logs with Tables ownership records to detect accesses where the requesting userId differs from the table owner.
Deploy web application firewall rules that rate-limit sequential numeric ID access to Tables endpoints.
Baseline typical column-access patterns per user and alert on deviations such as broad enumeration of IDs within short time windows.

Monitoring Recommendations

Enable verbose logging for the Tables app and forward Nextcloud logs to a centralized SIEM for retention and correlation.
Monitor the installed Tables app version across Nextcloud instances to confirm all nodes run 0.8.7, 0.9.4, or later.
Review HackerOne report #3138721 and the GHSA-p53h-6294-crjw advisory for additional context used to tune detections.

How to Mitigate CVE-2025-66553

Immediate Actions Required

Upgrade Nextcloud Tables to version 0.8.7 or 0.9.4 using the Nextcloud App Store or occ app:update tables.
Audit existing Tables content and rotate or restrict any sensitive schema that may have been exposed to non-owner accounts.
Review Nextcloud user accounts and disable or reset inactive accounts that could be abused for authenticated enumeration.

Patch Information

The fix is delivered in Nextcloud Tables 0.8.7 and 0.9.4 via pull request #1891 and commit e975f5b. Administrators should consult the GitHub Security Advisory GHSA-p53h-6294-crjw for upgrade guidance.

Workarounds

No official workaround exists. If an immediate upgrade is not possible, temporarily disable the Tables app with occ app:disable tables.
Restrict access to Nextcloud with network-level controls or VPN gating until patched versions are deployed.

bash

# Upgrade the Tables app on a Nextcloud instance
sudo -u www-data php occ app:update tables
sudo -u www-data php occ app:list | grep tables

# Temporary mitigation if upgrade is not immediately possible
sudo -u www-data php occ app:disable tables