Description
Nextcloud Tables allows you to create your own tables with individual columns. Prior to 0.8.9, 0.9.6, and 1.0.1, the information which table (numeric ID) is shared with which groups or users and the respective permissions was not limited to privileged users. This vulnerability is fixed in 0.8.9, 0.9.6, and 1.0.1.
Affected products
nextcloud: tables
References4
- github.com/nextcloud/security-advisories/security/advisories/GH… PatchVendor Advisory
- hackerone.com/reports/3334165 Issue TrackingVendor Advisory
- github.com/nextcloud/tables/commit/b92b9560b1e70a02b103a7aeb9e2… Patch
- github.com/nextcloud/tables/pull/2148 Issue TrackingPatch
Metrics
- CVSS 3.1
-
5.3
MEDIUM
Score source: NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - EPSS — exploit probability
- 0% percentile: 25 · as of 11 November 2026
- CWE
- CWE-639
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.