CVE-2025-66546

No fix known EPSS <1%CVSS 3.3

Nextcloud Calendar is a calendar app for Nextcloud. Prior to 4.7.19, 5.5.6, and 6.0.1, the calendar app allowed blindly booking appointments with a squential ID without known the appointment token. This vulnerability is fixed in 4.7.19, 5.5.6, and 6.0.1.

Published 2025-12-05 · CVE record · OSV

Products: nextcloud security-advisories