CVE-2025-59716: owncloud guests
Vulnerability summary
CVE-2025-59716 is a medium (CVSS 5.3) vulnerability in owncloud guests. EPSS estimates a 0.95% chance of exploitation in the next 30 days, higher than 60.6% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 05-11-2025PublishedVulnerability first disclosed.
- 05-11-2025Last modifiedVulnerability information updated.
Description
ownCloud Guests before 0.12.5 allows unauthenticated user enumeration via the /apps/guests/register/{email}/{token} endpoint. Because of insufficient validation of the supplied token in showPasswordForm, the server responds differently when an e-mail address corresponds to a valid pending guest user rather than a non-existent user.
CVSS metrics
2 scores · 2 sources · 1 version- NVDNIST5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS trend
Probability
0.95%
Chance of exploitation in the next 30 days
Percentile
61%
Versus all other CVEs
30-day change
+0.06 pp
From 0.89% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 found64Ae0449E909174D0479A4F23657147F
Maturity: poc
Weaknesses
CWE · root cause- CWE-200Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
- CWE-203Observable DiscrepancyThe product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor.
Affected systems
Owncloud1 product
- guests≤ 0.12.4
1 vendor · 1 product
References
4 links- github.com/owncloud/guestsProduct
- yeswehack.com/reports/411806Permissions Required