CVE-2025-66557

Nextcloud Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. Prior to 1.14.6 and 1.15.2, a bug in the permission logic allowed users with "Can share" permission to modify the permissions of other recipients. This vulnerability is fixed in 1.14.6 and 1.15.2.

• CWE-284

• https://github.com/nextcloud/deck/commit/f1da8b30a455f02373d44154da04494c949a95aePatch
• https://github.com/nextcloud/deck/pull/7131Issue Tracking, Patch
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-wwr8-hx9g-rjvvPatch, Vendor Advisory
• https://hackerone.com/reports/3247499Issue Tracking, Vendor Advisory

Published

Dec 5, 2025

Last Modified

Sep 25, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-66551Nextcloud Tables allows you to create your own tables with i…4.3
• CVE-2025-66552Nextcloud Server is a self hosted personal cloud system. In …4.3
• CVE-2025-66553Nextcloud Tables allows you to create your own tables with i…4.3
• CVE-2025-66554Contacts app for Nextcloud easily syncs contacts from variou…5.4
• CVE-2025-66555AirKeyboard iOS App 1.0.5 contains a missing authentication …8.8
• CVE-2025-66556Nextcloud talk is a video & audio conferencing app for Nextc…4.3
• CVE-2025-66558Nextcloud Twofactor WebAuthn is the WebAuthn Two-Factor Prov…4.3
• CVE-2025-66559Taiko Alethia is an Ethereum-equivalent, permissionless, bas…8
• CVE-2025-6656PDF-XChange Editor PRC File Parsing Out-Of-Bounds Read Infor…3.3
• CVE-2025-66560Quarkus is a Cloud Native, (Linux) Container First framework…7.5
• CVE-2025-66561SysReptor is a fully customizable pentest reporting platform…5.4
• CVE-2025-66562TUUI is a desktop MCP client designed as a tool unitary util…9.6