CVE-2025-66547

Nextcloud Server before versions 31.0.12 and 32.0.3 has a missing check of a relation, allowing authenticated users with access to any file comment to read the content of all comments.

In Nextcloud Server before versions 32.0.9 and 33.0.3, a pre-2FA session cookie can be reused as a Bearer token to authenticate against DAV endpoints, bypassing mandatory two-factor authentication.

In Nextcloud Server before versions 32.0.9 and 33.0.3, an attacker with knowledge of a user's password can bypass two-factor authentication by extracting a temporary session token and replaying it via HTTP Basic Authentication.

In Nextcloud Server before versions 32.0.9 and 33.0.3, sharing a folder or file with a team containing an external member automatically creates a public link that is invisible to the owner and cannot be revoked, granting full permissions.

Nextcloud Server from versions 32.0.0 to before 32.0.2, and 33.0.0 to before 33.0.1, the files_lock app did not properly validate the ownership of files when processing DAV lock and unlock requests. An authenticated user could lock or unlock files belonging to other users by targeting their absolute WebDAV paths. Additionally, lock tokens were disclosed to unauthorized callers in error responses, allowing attackers to remove token-based locks placed by other users' client applications. It is recommended that the Nextcloud Server is upgraded to 32.0.2 or 33.0.1. It is recommended that the Nextcloud Enterprise Server is upgraded to 31.0.14.4 or 32.0.2 or 33.0.1.

In Nextcloud Server before versions 32.0.9 and 33.0.3, an authenticated attacker can access attachments of link shares when knowing the share token, bypassing password protection or download restrictions.

An improper authorization vulnerability in the calendar backend of Nextcloud Server (versions 32.0.0-32.0.8 and 33.0.0-33.0.2) allows an authenticated attacker, knowing another user's principal URL, to gain full read and write access to that user's calendar.

In Nextcloud Server from versions 31.0.0 to before 31.0.14, and 32.0.0 to before 32.0.4, if {lang} is used in the template directory config value, non-admin users can in some cases copy arbitrary files (depending on unix permissions) into their own Nextcloud directory via a path traversal.

Nextcloud Server contains a vulnerability that allows a malicious user with access to a shared file to use the share token to directly access chunking uploads and view temporary part files during ongoing uploads. The issue affects versions from 32.0.0 to 32.0.8 and from 33.0.0 to 33.0.2.

Nextcloud Server 30.0.0 is vulnerable to an Insecure Direct Object Reference (IDOR) in the /core/preview endpoint. Any authenticated user can access previews of arbitrary files belonging to other users by manipulating the fileId parameter. This allows unauthorized disclosure of sensitive data, such as text files or images, without prior sharing permissions.