CVE-2025-66510: Nextcloud Server Contacts Search allowed users to retrieve contact information of other users beyond their contact list
Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server prior to 31.0.10 and 32.0.1 and Nextcloud Enterprise Server prior to 28.0.14.11, 29.0.16.8, 30.0.17.3, and 31.0.10, contacts search allowed to retrieve personal data of other users (emails, names, identifiers) without proper access control. This allows an authenticated user to retrieve information about accounts that are not related or added as contacts.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-66510?
CVE-2025-66510 has been classified as a high severity vulnerability due to the potential exposure of personal data.
How do I fix CVE-2025-66510?
To fix CVE-2025-66510, upgrade Nextcloud Server to version 31.0.10 or 32.0.1, or Nextcloud Enterprise Server to the respective patched versions.
What types of data can be compromised in CVE-2025-66510?
CVE-2025-66510 can potentially allow unauthorized users to access emails, names, and identifiers of other users.
Which versions of Nextcloud are affected by CVE-2025-66510?
CVE-2025-66510 affects Nextcloud Server versions prior to 31.0.10 and 32.0.1, and Nextcloud Enterprise Server versions prior to 28.0.14.11, 29.0.16.8, 30.0.17.3, and 31.0.10.
Can CVE-2025-66510 affect user privacy?
Yes, CVE-2025-66510 poses a significant threat to user privacy by potentially allowing data breaches of personal information.