Overview
This blog post details CVE-2025-66546, a low-severity vulnerability discovered in Nextcloud Calendar, a popular calendar application for Nextcloud. This vulnerability allowed attackers to potentially book appointments without knowing the appointment token by exploiting a sequential ID issue. Patches have been released to address this issue.
Technical Details
The vulnerability stemmed from the way Nextcloud Calendar handled appointment booking IDs. Prior to versions 4.7.19, 5.5.6, and 6.0.1, the application didn’t sufficiently validate appointment booking requests. An attacker could potentially predict and use sequential IDs to blindly book appointments, even without possessing the proper appointment token. This could lead to unauthorized calendar entries and potential disruption of scheduled events.
CVSS Analysis
The Common Vulnerability Scoring System (CVSS) score for CVE-2025-66546 is 3.3, which is considered LOW severity. This score reflects the limited scope of the vulnerability.
- CVSS v3 Base Score: 3.3
- Vector String: AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
- Explanation: Network attack vector, low attack complexity, no privileges required, user interaction required, no scope change, no impact on confidentiality, low impact on integrity, no impact on availability.
- Impact: The integrity impact is limited as an attacker can only inject a single unauthorized entry.
Possible Impact
While the CVSS score is low, the potential impact should not be ignored. An attacker exploiting this vulnerability could:
- Spam Calendars: Inject unwanted or malicious appointments into user calendars.
- Disrupt Schedules: Overlap or interfere with legitimate scheduled events, causing confusion or disruption.
- Phishing Attempts: Use malicious appointment descriptions to lure users into phishing scams.
Mitigation and Patch Steps
To mitigate the risk posed by CVE-2025-66546, it is strongly recommended that Nextcloud users upgrade their Calendar app to one of the following versions:
- 4.7.19 or later
- 5.5.6 or later
- 6.0.1 or later
You can update the Calendar app through the Nextcloud App Store. Ensure you back up your data before performing any updates.
