CVE-2025-66557: Nextcloud Deck

Medium severity, CVSS 4.3. EPSS: 0.3% chance of exploitation in the next 30 days.

Nextcloud Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. Prior to 1.14.6 and 1.15.2, a bug in the permission logic allowed users with "Can share" permission to modify the permissions of other recipients. This vulnerability is fixed in 1.14.6 and 1.15.2.

Affected products

• Nextcloud Deck: from 1.14.0, before 1.14.6 (fixed in 1.14.6); from 1.15.0, before 1.15.2 (fixed in 1.15.2)

Published 2025-12-05. Last modified 2026-09-25.