---
id: CVE-2025-66513
title: Nextcloud Tables allows you to create your own tables with individual columns
summary: >-
  Nextcloud Tables allows you to create your own tables with individual columns.
  Prior to 0.8.9, 0.9.6, and 1.0.1, the information which table (numeric ID) is
  shared with which groups or users and the respective permissions was not
  limited…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N'
cwe:
  - CWE-639
vendor: nextcloud
product: tables
affected:
  - 'tables >= 0.6.0, < 0.8.9'
  - 'tables >= 0.9.0, < 0.9.6'
  - 'tables >= 1.0.0, < 1.0.1'
patched:
  - tables 1.0.1
published: '2025-12-05'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T21:10:00.327'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-66513'
references:
  - url: >-
      https://github.com/nextcloud/security-advisories/security/advisories/GHSA-2cwj-qp49-4xfw
    label: security-advisories@github.com
  - url: >-
      https://github.com/nextcloud/tables/commit/b92b9560b1e70a02b103a7aeb9e22e2ab5231873
    label: security-advisories@github.com
  - url: 'https://github.com/nextcloud/tables/pull/2148'
    label: security-advisories@github.com
  - url: 'https://hackerone.com/reports/3334165'
    label: security-advisories@github.com
tags:
  - nvd
epss: 0.00295
epssPercentile: 0.22
ingestedAt: '2026-10-27T18:12:09.277Z'
---

## Overview

Nextcloud Tables allows you to create your own tables with individual columns. Prior to 0.8.9, 0.9.6, and 1.0.1, the information which table (numeric ID) is shared with which groups or users and the respective permissions was not limited to privileged users. This vulnerability is fixed in 0.8.9, 0.9.6, and 1.0.1.

## Affected

- `tables >= 0.6.0, < 0.8.9`
- `tables >= 0.9.0, < 0.9.6`
- `tables >= 1.0.0, < 1.0.1`

## Remediation

Upgrade past the affected range:

- `tables 1.0.1`