CVE-2025-66547

Description

Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server and Enterprise Server prior to 31.0.1, non-privileged users can modify tags on files they should not have access to via bulk tagging. This vulnerability is fixed in 31.0.1.

PUBLISHED Reserved 2025-12-04 | Published 2025-12-05 | Updated 2025-12-05 | Assigner GitHub_M

Problem types

CWE-639: Authorization Bypass Through User-Controlled Key

Product status

References

github.com/...sories/security/advisories/GHSA-hq6c-r898-fgf2

github.com/nextcloud/server/issues/51247

github.com/nextcloud/server/pull/51288

github.com/...ommit/b44f1568f2dc97c746281d99e2342ad679e3d8a9

hackerone.com/reports/3040887

cve.org (CVE-2025-66547)

nvd.nist.gov (CVE-2025-66547)