CVE-2025-66510
Medium · 4.5CVSS
4.5
EPSS
0.4%
Published
Dec 5, 2025
CISA due date
—
The record
Nextcloud Server Contacts Search allowed users to retrieve contact information of other users beyond their contact list
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Chainguard | nextcloud-server-30-apache2-config | 0 | 30.0.17-r0 |
Related vulnerabilities
- CVE-2025-14761 Missing cryptographic key commitment in the AWS SDK for PHP may allow a user with write… Also affects nextcloud-server-30-apache2-config
- CVE-2025-66552 Nextcloud Server admin_audit does not log all actions on files in groupfolders Also affects nextcloud-server-30-apache2-config
- CVE-2025-66547 Nextcloud Server users can modify tags on files that do not belong to them Also affects nextcloud-server-30-apache2-config
- CVE-2025-64500 Symfony's incorrect parsing of PATH_INFO can lead to limited authorization bypass Also affects nextcloud-server-30-apache2-config
- CVE-2026-73008 Exposure of private personal information to an unauthorized actor in Windows Biometric… CWE-359
- CVE-2026-21827 HCL Connections is vulnerable to an information disclosure vulnerability which could… CWE-359
- CVE-2026-74966 Information disclosure in the Form Autofill component. CWE-359
- CVE-2026-58510 GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code… CWE-359