CVE-2025-66557: Nextcloud Deck Auth Bypass Vulnerability

CVE-2025-66557 Overview

CVE-2025-66557 is a broken access control vulnerability in Nextcloud Deck, a kanban-style organization tool integrated with Nextcloud. A flaw in the permission logic allowed users holding only the Can share permission to modify the permissions assigned to other recipients of a shared board. The issue is tracked under [CWE-284: Improper Access Control] and affects versions prior to 1.14.6 and 1.15.2. Nextcloud resolved the issue in releases 1.14.6 and 1.15.2.

Critical Impact
Authenticated users with Can share rights could alter the edit, share, and manage permissions of other board recipients, breaking the intended authorization model.

Affected Products

Nextcloud Deck versions prior to 1.14.6
Nextcloud Deck 1.15.0 and 1.15.1
Nextcloud instances with the Deck app installed

Discovery Timeline

2025-12-05 - CVE-2025-66557 published to NVD
2026-09-25 - Last updated in NVD database

Technical Details for CVE-2025-66557

Vulnerability Analysis

The vulnerability resides in the applyPermissions method of lib/Service/BoardService.php within the Nextcloud Deck application. When a user without the PERMISSION_MANAGE right attempted to update board Access Control List (ACL) entries, the service recomputed the three permission flags (edit, share, manage) by combining the requested values with the acting user's own permissions using a logical AND. A user with only the Can share permission could therefore pass arbitrary values for edit and manage, and the function would silently overwrite the previous ACL state for the target recipient. The vulnerability is network reachable and requires low privileges, and impacts integrity but not confidentiality or availability.

Root Cause

The root cause is improper authorization logic that conflated the acting user's permission scope with the ACL state of the target recipient. Instead of preserving the recipient's existing ACL entry when the acting user lacked a given permission, the original code reset that permission bit to false or allowed the caller's input to pass through. There was no fallback to the previously stored ACL values, so any permission the acting user could not grant was effectively rewritten rather than preserved.

Attack Vector

An authenticated Nextcloud user who has been granted a board share with the Can share right targets another recipient of the same board. By calling the board update endpoint and specifying new values for the recipient's edit, share, or manage fields, the attacker triggers applyPermissions with elevated or reduced rights for that user. The attacker does not need PERMISSION_MANAGE, which is normally required to administer board ACLs.

php

// Patch in lib/Service/BoardService.php (Nextcloud Deck PR #7131)
-	private function applyPermissions($boardId, $edit, $share, $manage) {
+	private function applyPermissions($boardId, $edit, $share, $manage, $oldAcl = null) {
 		try {
 			$this->permissionService->checkPermission($this->boardMapper, $boardId, Acl::PERMISSION_MANAGE);
 		} catch (NoPermissionException $e) {
 			$acls = $this->aclMapper->findAll($boardId);
-			$edit = $this->permissionService->userCan($acls, Acl::PERMISSION_EDIT, $this->userId) && $edit;
-			$share = $this->permissionService->userCan($acls, Acl::PERMISSION_SHARE, $this->userId) && $share;
-			$manage = $this->permissionService->userCan($acls, Acl::PERMISSION_MANAGE, $this->userId) && $manage;
+			$edit = $this->permissionService->userCan($acls, Acl::PERMISSION_EDIT, $this->userId) ? $edit : $oldAcl?->getPermissionEdit() ?? false;
+			$share = $this->permissionService->userCan($acls, Acl::PERMISSION_SHARE, $this->userId) ? $share : $oldAcl?->getPermissionShare() ?? false;
+			$manage = $this->permissionService->userCan($acls, Acl::PERMISSION_MANAGE, $this->userId) ? $manage : $oldAcl?->getPermissionManage() ?? false;
 		}
 		return [$edit, $share, $manage];
 	}

Source: Nextcloud Deck commit f1da8b3. The fix passes the previous ACL into applyPermissions and falls back to the stored permission values when the acting user cannot grant a given right, preventing silent downgrades or escalations.

Detection Methods for CVE-2025-66557

Indicators of Compromise

Entries in the Nextcloud oc_deck_board_acl table where a recipient's permission_edit, permission_share, or permission_manage values changed without an audit event from an administrator or board owner.
Nextcloud audit log entries for the Deck app showing ACL updates performed by users who do not hold PERMISSION_MANAGE on the affected board.
Unexpected board membership permission changes reported by end users on shared Deck boards.

Detection Strategies

Query the Deck database for ACL rows modified between the vulnerable release window and the upgrade to 1.14.6 or 1.15.2, and correlate with the acting user's permissions at the time.
Enable and review the Nextcloud admin_audit app to capture Deck sharing and permission change events.
Alert on repeated ACL modifications targeting the same board or recipient by non-owner accounts.

Monitoring Recommendations

Forward Nextcloud application and audit logs to a centralized log platform and retain them for post-incident review.
Track the installed version of the Deck app across Nextcloud instances to confirm patched builds are deployed.
Monitor HTTP requests to /apps/deck/boards/{boardId}/acl/* endpoints for anomalous update patterns from standard user accounts.

How to Mitigate CVE-2025-66557

Immediate Actions Required

Upgrade Nextcloud Deck to version 1.14.6 or 1.15.2 using the Nextcloud app store or occ app:update deck.
Audit existing board ACLs for unexpected edit, share, or manage grants and restore intended permissions.
Review the list of users holding Can share on sensitive boards and reduce the permission where it is not required.

Patch Information

The fix is delivered in Nextcloud Deck 1.14.6 and 1.15.2 via Pull Request #7131 and commit f1da8b3. Full details are available in the GitHub Security Advisory GHSA-wwr8-hx9g-rjvv and the original HackerOne Report #3247499.

Workarounds

Temporarily disable the Deck app on affected Nextcloud instances until the upgrade is applied.
Restrict the Can share permission to trusted users only on boards containing sensitive data.
Re-create board ACLs after upgrade for boards where tampering is suspected.

bash

# Upgrade Nextcloud Deck via the occ command
sudo -u www-data php occ app:update deck
sudo -u www-data php occ app:list | grep deck
# Confirm installed version is 1.14.6 or 1.15.2 or later