CVE-2025-66551: 
NixOS vulnerability analysis and mitigation

CVE-2025-66551 is an authorization bypass vulnerability in the Nextcloud Tables app that allows an authenticated malicious user to create their own table and then move a column into another user's table without authorization. It affects Nextcloud Tables versions 0.4.0 through 0.8.5 and 0.9.0 through 0.9.2. The vulnerability was published on December 5, 2025, and patches were released on December 9, 2025. It carries a CVSS v3.1 base score of 4.3 (Medium) per NVD, and 6.3 (Moderate) per the GitHub Security Advisory (GitHub Advisory, Feedly).

The root cause is a missing ownership check in the Tables app's column management logic, classified as CWE-639 (Authorization Bypass Through User-Controlled Key). Specifically, the private ColumnsController allowed a user to update a column's tableId field without verifying that the target table belongs to the requesting user, enabling cross-table column injection. The fix removed the vulnerable ColumnsController entirely and migrated all column operations to the Api1Controller, which enforces proper ownership validation; additionally, the tableId parameter was removed from the ColumnService::update() method to prevent table reassignment (GitHub Advisory, Fix Commit).

A low-privileged authenticated attacker can manipulate the structure of another user's table by injecting unauthorized columns, leading to data integrity violations, corruption of table schemas, and potential disruption of workflows dependent on those tables. There is no confidentiality impact (no data read access is gained), but integrity impact is rated High in the GitHub advisory due to the ability to modify victim-owned data structures. Availability may also be partially affected if injected columns disrupt table functionality (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.03%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires a valid low-privilege account on the Nextcloud instance and some user interaction (Feedly, GitHub Advisory).

1. Authenticate: Log in to the Nextcloud instance with a low-privilege user account that has access to the Tables app.
2. Create attacker-controlled table: Use the Tables app to create a new table with at least one column under the attacker's account.
3. Identify victim's table ID: Enumerate or guess the numeric table ID of a target user's table (e.g., via the Tables API or UI).
4. Send malicious update request: Using the now-removed private ColumnsController endpoint (e.g., PUT /apps/tables/column/{columnId}), send a crafted HTTP PUT request with the attacker's column ID and set the tableId parameter to the victim's table ID — bypassing ownership validation.
5. Column moved to victim's table: The server updates the column's tableId without verifying ownership, effectively injecting the attacker's column into the victim's table and corrupting its structure (GitHub Advisory, Fix Commit).

• Network: Unexpected HTTP PUT requests to /apps/tables/column/{id} (the deprecated private ColumnsController endpoint) from authenticated users, particularly with a tableId value not owned by the requesting user.
• Logs: Nextcloud application logs showing column update operations where the source user does not own the target tableId; repeated API calls to column update endpoints across different table IDs from the same user account.
• Application: Unexpected columns appearing in a user's table that were not created by that user; table schema changes not initiated by the table owner.

Upgrade Nextcloud Tables to version 0.8.6 (for the 0.8.x branch) or 0.9.3 (for the 0.9.x branch) to remediate this vulnerability. If an immediate upgrade is not possible, the official workaround is to disable the Tables app entirely within the Nextcloud admin panel until patching can be performed. Administrators should also audit existing tables for unexpected columns as a post-incident check (GitHub Advisory).