PT-2025-49268

CVE-2025-66547

·

Published

2025-12-05

·

Updated

2026-10-18

Description by

CVSS 3.1
4.3
Medium
MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Name of the Vulnerable Software and Affected Versions Nextcloud Server and Enterprise Server versions prior to 31.0.1
Description Non-privileged users can modify tags on files they should not have access to through bulk tagging. This affects a self-hosted personal cloud system.
Recommendations Update to version 31.0.1 or later.
Exploitability
Exploit
Fix
Impacts
Vendors
Affected products
Weakness enumeration
CWE-639: Authorization Bypass Through User-Controlled Key
Related identifiers
CVE-2025-66547
BDU:2026-03382
GHSA-HQ6C-R898-FGF2
BIT-NEXTCLOUD-2025-66547
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com