CVE-2025-66547
Nextcloud Server users can modify tags on files that do not belong to them
Summary
Nextcloud Server users can modify tags on files that do not belong to them
Original description
The description as published by the source.
Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server and Enterprise Server prior to 31.0.1, non-privileged users can modify tags on files they should not have access to via bulk tagging. This vulnerability is fixed in 31.0.1.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Affected packages
Bitnami
nextcloud
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"31.0.1"}]}]
References
- advisory github.com
- advisory nvd.nist.gov
- advisory github.com
- patch github.com
- patch github.com
- report github.com
- web hackerone.com