CVE-2025-66553: 
NixOS vulnerability analysis and mitigation

CVE-2025-66553 is an authorization bypass vulnerability in the Nextcloud Tables app that allows authenticated users to view column metadata from tables they do not have access to. By manipulating the numeric ID in an API request, any authenticated user can enumerate and read structural metadata (column definitions) of arbitrary tables. The vulnerability affects Tables versions 0.8.0–0.8.6 and 0.9.0–0.9.3, and was disclosed on December 5, 2025. It carries a CVSS v3.1 base score of 4.3 (Medium) (GitHub Advisory, Feedly).

The root cause is an insecure direct object reference (IDOR) flaw classified as CWE-639 (Authorization Bypass Through User-Controlled Key). The findAllByTable method in ColumnService.php previously accepted an optional $viewId parameter, and the permission check allowed access if either the table ID or the view ID passed authorization — meaning a user could supply a valid view ID they had access to alongside an arbitrary table ID to bypass table-level access controls. The fix, merged in pull request #1891, removes the $viewId bypass from findAllByTable and introduces a separate findAllByManagedView method with proper permission enforcement, ensuring table column lookups are gated solely on table-level read permissions (GitHub Advisory, Fix Commit).

Successful exploitation allows an authenticated attacker to enumerate column metadata (e.g., column names, types, and configuration) from any table in the Nextcloud Tables app, regardless of whether they have been granted access to that table. This is a confidentiality-only impact — integrity and availability are not affected. While the exposed data is structural metadata rather than row content, it could reveal sensitive schema information and aid further reconnaissance or social engineering attacks (GitHub Advisory).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported. The vulnerability requires a valid authenticated session, lowering the risk of mass exploitation. The EPSS score is approximately 0.026% (very low probability of exploitation in the near term), and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The original report was submitted via HackerOne (HackerOne, Feedly).

1. Authentication: Log in to a Nextcloud instance with any valid user account that has access to the Tables app.
2. Identify a known table ID: Note the numeric ID of a table the attacker legitimately has access to (visible in the URL or API responses).
3. Craft a malicious API request: Send an HTTP GET request to the Tables API endpoint for column listing (e.g., /index.php/apps/tables/api/1/tables/{targetTableId}/columns), substituting {targetTableId} with an incremented or guessed numeric ID belonging to another user's table.
4. Bypass authorization: In vulnerable versions, the permission check could be bypassed by also supplying a viewId the attacker controls, allowing the server to return column metadata for the target table without proper access validation.
5. Enumerate metadata: Iterate over numeric table IDs to systematically collect column names, types, and configuration details from tables across the Nextcloud instance (GitHub Advisory, Fix Commit).

• Network: Repeated API requests to /index.php/apps/tables/api/1/tables/{id}/columns with sequentially or randomly varying numeric table IDs from a single authenticated user session.
• Logs: Nextcloud application logs showing a single user account querying column metadata for a large number of distinct table IDs in a short time window, particularly for tables not shared with that user.
• Logs: HTTP 200 responses to column metadata requests for table IDs that the requesting user does not own or have explicit share access to (visible in Nextcloud access logs prior to patching).

Upgrade the Nextcloud Tables app to version 0.8.7 (for the 0.8.x branch) or 0.9.4 (for the 0.9.x branch), which contain the fix. If an immediate upgrade is not possible, the official workaround is to disable the Tables app entirely within the Nextcloud admin panel until patching can be performed. No other configuration-based mitigations are available (GitHub Advisory).