{
  "affected": [
    {
      "ranges": [
        {
          "database_specific": {
            "cpe": "cpe:2.3:a:nextcloud:group_folders:*:*:*:*:*:*:*:*",
            "extracted_events": [
              {
                "introduced": "0"
              },
              {
                "fixed": "14.0.11"
              },
              {
                "introduced": "15.0.0"
              },
              {
                "fixed": "15.3.12"
              },
              {
                "introduced": "16.0.0"
              },
              {
                "fixed": "16.0.15"
              },
              {
                "introduced": "17.0.0"
              },
              {
                "fixed": "17.0.14"
              },
              {
                "introduced": "18.0.0"
              },
              {
                "fixed": "18.1.8"
              },
              {
                "introduced": "19.0.0"
              },
              {
                "fixed": "20.1.2"
              }
            ],
            "source": [
              "CPE_RANGE",
              "REFERENCES"
            ]
          },
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "c7ee8dfee0a466f5ba701872b3b0e0957641487d"
            },
            {
              "introduced": "b2c1c5e626bfa4c046b93ed01567207e9e50cffd"
            },
            {
              "fixed": "1b849acc9840cdab2e5c701594fe72dd9894cb57"
            },
            {
              "introduced": "fe0278e4f44e4e75b49d6914aad759be81bf9f3e"
            },
            {
              "fixed": "b5de0e74c9241a3931d8a8789e0055418596faf2"
            },
            {
              "introduced": "8f0d9cb8f8438e863af4d2cf58c99d3e1892f6b6"
            },
            {
              "fixed": "9e833b8318792b425af2a476b466dda96e51c78a"
            },
            {
              "introduced": "9d0b381c73939a2220f252d6e6797a50c53b1268"
            },
            {
              "fixed": "37e69cbe266ffd190c9871b5174f3e901902aec9"
            },
            {
              "introduced": "537df83a0b39e0c3eac8d7ad45a3d53f746d5f33"
            },
            {
              "fixed": "ffcfdc30bbe806149005c586ccf0edc36216d1b1"
            },
            {
              "fixed": "bbe87ebed8da23e9df4db637a76fbc8d36439d58"
            }
          ],
          "repo": "https://github.com/nextcloud/groupfolders",
          "type": "GIT"
        }
      ]
    }
  ],
  "aliases": [
    "GHSA-2vrq-fhmf-c49m"
  ],
  "database_specific": {
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
      "CWE-707"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66545.json"
  },
  "details": "Nextcloud Groupfolders provides admin-configured folders shared by everyone in a group or team. Prior to 14.0.11, 15.3.12, 16.0.15, 17.0.14, 18.1.8, 19.1.8, and 20.1.2, a user with read-only permission can restore a file from the trash bin. This vulnerability is fixed in 14.0.11, 15.3.12, 16.0.15, 17.0.14, 18.1.8, 19.1.8, and 20.1.2.",
  "id": "CVE-2025-66545",
  "modified": "2026-07-15T01:49:11.381632028Z",
  "published": "2025-12-05T17:44:13.312Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66545.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-2vrq-fhmf-c49m"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66545"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/nextcloud/groupfolders/issues/4041"
    },
    {
      "type": "FIX",
      "url": "https://github.com/nextcloud/groupfolders/commit/bbe87ebed8da23e9df4db637a76fbc8d36439d58"
    },
    {
      "type": "FIX",
      "url": "https://github.com/nextcloud/groupfolders/pull/4076"
    }
  ],
  "schema_version": "1.8.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Nextcloud Groupfolders users with read-only permissions for team folder can restore deleted files from trash bin"
}