{"id":"CVE-2025-66551","title":"Nextcloud Tables allows you to create your own tables with individual columns","summary":"Nextcloud Tables allows you to create your own tables with individual columns. Prior to 0.8.6 and 0.9.3, a malicious user was able to create their own table and then move a column to a victims table. This vulnerability is fixed in 0.8.6 …","severity":"medium","cvss":6.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:L","cwe":["CWE-639"],"vendor":"nextcloud","product":"tables","affected":["tables >= 0.4.0, < 0.8.6","tables >= 0.9.0, < 0.9.3"],"patched":["tables 0.9.3"],"published":"2025-12-05","updated":"2026-09-25","sourceUpdated":"2026-09-25T23:10:00.463","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-66551","references":[{"url":"https://github.com/nextcloud/security-advisories/security/advisories/GHSA-w787-vwqp-8wr7","label":"security-advisories@github.com"},{"url":"https://github.com/nextcloud/tables/commit/39f24a62fb41fd7a8bda65325f8bbafdc91c731c","label":"security-advisories@github.com"},{"url":"https://github.com/nextcloud/tables/pull/1810","label":"security-advisories@github.com"},{"url":"https://hackerone.com/reports/3137895","label":"security-advisories@github.com"}],"tags":["nvd"],"epss":0.00253,"epssPercentile":0.15048,"ingestedAt":"2026-09-25T23:21:16.897Z","slug":"CVE-2025-66551","body":"## Overview\n\nNextcloud Tables allows you to create your own tables with individual columns. Prior to 0.8.6 and 0.9.3, a malicious user was able to create their own table and then move a column to a victims table. This vulnerability is fixed in 0.8.6 and 0.9.3.\n\n## Affected\n\n- `tables >= 0.4.0, < 0.8.6`\n- `tables >= 0.9.0, < 0.9.3`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `tables 0.9.3`","depth":"sunlit","depthScore":35,"depthScoreParts":{"impact":34.7,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}