Listen to this Post
CVE-2025-66551 exploits an authorization bypass in Nextcloud Tables’ column movement functionality. In versions before 0.8.6 and 0.9.3, the application inadequately validates user permissions during column transfer operations. A malicious authenticated user can create a personal table, add a column, and then issue a crafted HTTP request to move that column to another user’s table. The server-side processing fails to check if the requester has write access to the target table’s ID. This flaw resides in the column management endpoint, where the destination table parameter is trusted without authorization. The move action proceeds regardless of ownership, allowing unauthorized insertion of columns into any table. This can corrupt table structure, lead to data confusion, privacy leaks, or facilitate other attacks. The vulnerability requires network access and a valid user account. The fix implements proper checks to ensure users only move columns to tables they own or have explicit edit rights for.
Platform: Nextcloud Tables
Version: Prior 0.8.6 0.9.3
Vulnerability: Unauthorized column movement
Severity: Medium
date: 12/05/2025
Prediction: Expected patch: 2025-12-05
What Undercode Say:
Analytics:
php occ app:list | grep tables
php occ app:get version tables
php occ app:update tables
How Exploit:
Create table column. Craft move request. Target victim table.
Protection from this CVE:
Update to 0.8.6 or 0.9.3.
Impact:
Unauthorized table modification. Data integrity loss.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
