---
id: CVE-2025-64011
title: >-
  Nextcloud Server 30.0.0 is vulnerable to an Insecure Direct Object Reference
  (IDOR) in the /core/preview endpoint
summary: >-
  Nextcloud Server 30.0.0 is vulnerable to an Insecure Direct Object Reference
  (IDOR) in the /core/preview endpoint. Any authenticated user can access
  previews of arbitrary files belonging to other users by manipulating the
  fileId paramete…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'
cwe:
  - CWE-639
vendor: nextcloud
product: nextcloud_server
affected:
  - nextcloud_server = 30.0.0
published: '2025-12-12'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T17:10:00.210'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-64011'
references:
  - url: >-
      https://drive.google.com/file/d/1eD3PN-u1caZYgGH96XHmJ7h_OBXEAHW4/view?usp=sharing
    label: cve@mitre.org
  - url: 'https://gist.github.com/tarekramm/586dfe2d113fedfee6d71182570fc090'
    label: cve@mitre.org
  - url: 'https://nextcloud.com'
    label: cve@mitre.org
tags:
  - nvd
epss: 0.00275
epssPercentile: 0.18554
ingestedAt: '2026-10-14T17:44:53.606Z'
---

## Overview

Nextcloud Server 30.0.0 is vulnerable to an Insecure Direct Object Reference (IDOR) in the /core/preview endpoint. Any authenticated user can access previews of arbitrary files belonging to other users by manipulating the fileId parameter. This allows unauthorized disclosure of sensitive data, such as text files or images, without prior sharing permissions.

## Affected

- `nextcloud_server = 30.0.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.