Listen to this Post
CVE-2025-66547 is an access control vulnerability in Nextcloud Server’s bulk tagging feature. The flaw exists in versions prior to 31.0.1, where the system does not properly validate user permissions during batch tag operations. When a non-privileged user initiates a bulk tag modification, the server processes the request for all specified file IDs without verifying if the user has read or write access to each individual file. This occurs because the authorization check is bypassed or insufficient at the endpoint handling bulk actions. Attackers can exploit this by sending crafted HTTP POST requests to the tagging API, including IDs of files they do not own or lack permissions for. The vulnerability leverages the discrepancy between UI-level checks and server-side validation, allowing authenticated users to alter tags on private or shared files. This can lead to data misclassification, disruption of organized storage, and privacy breaches by manipulating tag-based search and automation. The issue is fixed in version 31.0.1 by implementing proper permission checks for each file during bulk tag operations.
Platform: Nextcloud Server
Version: Before 31.0.1
Vulnerability: Unauthorized Tag Modification
Severity: Critical
date: 12/05/2025
Prediction: Fixed 31.0.1
What Undercode Say:
Analytics:
Check installed Nextcloud version
php occ config:system:get version
Example curl for bulk tagging (illustrative)
curl -X POST -H “OCS-APIREQUEST: true” -u user:pass -d ‘{“tagName”:”confidential”,”fileIds”:[123,456]}’ https://nc.example.com/remote.php/dav/systemtags-relations
Update Nextcloud to patched version
sudo occ upgrade
how Exploit:
Authenticate low-privilege user.
Craft bulk tag request.
Include unauthorized file IDs.
Server modifies tags.
Protection from this CVE:
Update to 31.0.1.
Review sharing permissions.
Disable unused features.
Impact:
Tag manipulation bypass.
Data integrity loss.
Privacy breaches possible.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
