Description
Contacts app for Nextcloud easily syncs contacts from various devices with your Nextcloud and allows editing. Prior to 5.5.4, 6.0.6, and 7.2.5, a malicious user was able to modify their organisation and title field to load additional CSS files. Javascript and other options were correctly blocked by the content security policy of the Nextcloud Server code. This vulnerability is fixed in 5.5.4, 6.0.6, and 7.2.5.
Affected products
nextcloud: contacts
References4
- github.com/nextcloud/security-advisories/security/advisories/GH… PatchVendor Advisory
- hackerone.com/reports/3293290 Permissions RequiredVendor Advisory
- github.com/nextcloud/contacts/commit/d954d098978dde1f121600e8b9… Patch
- github.com/nextcloud/contacts/pull/4619 Issue TrackingPatch
Metrics
- CVSS 3.1
-
5.4
MEDIUM
Score source: NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - EPSS — exploit probability
- 0% percentile: 19 · as of 11 November 2026
- CWE
- CWE-79
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.