Vulnerabilidades do Nextcloud Calendar
🔔 Criar alerta RSS Verificador de versão
CVEs publicadas que afetam Nextcloud Calendar: 4 registro(s), com versões afetadas e correções.cpe:2.3:a:nextcloud:calendar
CVE-2026-45286
Média · 4.3
CWE-200 01/06/2026
Nextcloud: Calendar app leaked user identifiers via attendee suggestion endpoint
Nextcloud is an open source content collaboration platform. From versions 5.5.13 to before 5.5.17, and 6.2.0 to before 6.2.3, an authenticated user can enumerate users on the same Nextcloud instance by using the Calendar app's endpoint for suggesting attendees. The sharing restrictions, applied to other endpoints, were not effective here. This issue has been patched in versions 5.5.17 and 6.2.3.
CVE-2025-66550
Média · 5.7
CWE-241 05/12/2025
Nextcloud Calendar attachments of local files are offered to downloaded
Nextcloud Calendar is a calendar app for Nextcloud. Prior to 4.7.17 and 5.2.4, when a malicious user creates a calendar event with a crafted attachment that links to a download link of a file on the same Nextcloud server, the file would be downloaded without the user confirming the action. This vulnerability is fixed in 4.7.17 and 5.2.4.
CVE-2025-66546
Baixa · 3.3
CWE-639 05/12/2025
Nextcloud Calendar app allowed booking appointments without the generated token
Nextcloud Calendar is a calendar app for Nextcloud. Prior to 4.7.19, 5.5.6, and 6.0.1, the calendar app allowed blindly booking appointments with a squential ID without known the appointment token. This vulnerability is fixed in 4.7.19, 5.5.6, and 6.0.1.
CVE-2025-66511
Média · 6.5
CWE-330 05/12/2025
Nextcloud Calendar app used predictable proposal participant tokens
Nextcloud Calendar is a calendar app for Nextcloud. Prior to 6.0.3, the Calendar app generates participant tokens for meeting proposals using a hash function, allowing an attacker to compute valid participant tokens, which allowed them to request details and submit dates in meeting proposals. The tokens are not purely random generated. This vulnerability is fixed in 6.0.3.