Vulnerability · Published Dec 5, 2025 · Assigned by GitHub_M

CVE-2025-66511Nextcloud Calendar app used predictable proposal participant tokens

Medium 4.8

In plain English

A medium-severity weak randomness in security-advisories from nextcloud. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities).

Severity (CVSS 3.1)4.8Medium

Exploit odds (30 days)0.3%top 75.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Nextcloud Calendar is a calendar app for Nextcloud. Prior to 6.0.3, the Calendar app generates participant tokens for meeting proposals using a hash function, allowing an attacker to compute valid participant tokens, which allowed them to request details and submit dates in meeting proposals. The tokens are not purely random generated. This vulnerability is fixed in 6.0.3.

Affected products (as reported)

Vendor	Product	Versions
nextcloud	security-advisories	>= 6.0.0-rc.1, < 6.0.3

Weakness: CWE-330 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

References

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-whm3-vv55-gf27 x_refsource_CONFIRM
https://github.com/nextcloud/calendar/pull/7659 x_refsource_MISC
https://github.com/nextcloud/calendar/commit/8de14ae87f321f5f09280d9895a27d54d24f33fb x_refsource_MISC
https://hackerone.com/reports/3385434 x_refsource_MISC