Description
Nextcloud Tables allows you to create your own tables with individual columns. Prior to 0.8.7 and 0.9.4, authenticated users were able to view meta data of columns in other tables of the Tables app by modifying the numeric ID in a request. This vulnerability is fixed in 0.8.7 and 0.9.4.
Affected products
nextcloud: tables
References4
- github.com/nextcloud/security-advisories/security/advisories/GH… PatchVendor Advisory
- hackerone.com/reports/3138721 Issue TrackingVendor Advisory
- github.com/nextcloud/tables/commit/e975f5bfedb6922f04cdd236cde4… Patch
- github.com/nextcloud/tables/pull/1891 Issue Tracking
Metrics
- CVSS 3.1
-
4.3
MEDIUM
Score source: CNA
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - EPSS — exploit probability
- 0% percentile: 23 · as of 11 November 2026
- CWE
- CWE-639
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.