ownCloud Guests - User Enumeration

mediumseverity

5.3CVSS score

1%likelihood of exploitation, next 30 days

62%of all CVEs are less likely

Readycheck to confirm it

ownCloud Guests before 0.12.5 contains an unauthenticated user enumeration vulnerability caused by insufficient validation of the token in showPasswordForm at /apps/guests/register/{email}/{token}, letting unauthenticated attackers enumerate valid guest users, exploit requires no authentication.

Impact

Unauthenticated attackers can enumerate valid guest users, potentially aiding further targeted attacks.

Fix

Update to version 0.12.5 or later.

How to confirm it

Send: GET {{BaseURL}}/apps/guests/register/{{email}}/invalid-token-12345
Positive when: contains "No such guest user" and "ownCloud" AND status 200

Run it with nuclei: nuclei -id CVE-2025-59716 -u <target>

The full check

id: CVE-2025-59716

info:
  name: ownCloud Guests - User Enumeration
  author: DhiyaneshDk
  severity: medium
  description: |
    ownCloud Guests before 0.12.5 contains an unauthenticated user enumeration vulnerability caused by insufficient validation of the token in showPasswordForm at /apps/guests/register/{email}/{token}, letting unauthenticated attackers enumerate valid guest users, exploit requires no authentication.
  impact: |
    Unauthenticated attackers can enumerate valid guest users, potentially aiding further targeted attacks.
  remediation: |
    Update to version 0.12.5 or later.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-59716
    - https://gist.github.com/thesmartshadow/64ae0449e909174d0479a4f23657147f
    - https://marketplace.owncloud.com/apps/guests
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2025-59716
    epss-score: 0.00951
    epss-percentile: 0.61598
    cwe-id: CWE-203
  metadata:
    verified: true
    max-request: 1
    vendor: owncloud
    product: guests
    shodan-query: http.title:"ownCloud"
    fofa-query: title="ownCloud"
  tags: cve,cve2025,owncloud,enum,user-enum,guests,vkev

variables:
  email: "{{randstr}}@{{rand_base(5)}}.com"

http:
  - method: GET
    path:
      - "{{BaseURL}}/apps/guests/register/{{email}}/invalid-token-12345"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "No such guest user"
          - "ownCloud"
        condition: and

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from