CVE-2025-66557

MediumCVSS 5.4

Published: 05/12/2025(UTC)Updated: 25/09/2026(UTC)Translated: 26/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.28%

18th percentile - higher than 18% of all known CVEs

Summary

Nextcloud Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. Prior to 1.14.6 and 1.15.2, a bug in the permission logic allowed users with "Can share" permission to modify the permissions of other recipients. This vulnerability is fixed in 1.14.6 and 1.15.2.

Risk Assessment

A user with share permission can modify the permissions of other recipients, potentially leading to unauthorized data access or privilege escalation.

Recommendation

Update Nextcloud Deck to version 1.14.6 or 1.15.2 (or later).

Other vulnerabilities in Nextcloud Deck

CVE-2025-66548Low
In Nextcloud Deck prior to 1.12.7, 1.14.4, and 1.15.1, file extension can be spoofed by using RTLO characters, tricking users into downloading files with a different extension than what is displayed. This vulnerability is fixed in 1.12.7, 1.14.4, and 1.15.1.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS