CVE-2025-59716

MEDIUM EXPLOITED NUCLEI

owncloud guests < 0.12.4 - Unauthenticated User Enumeration via Registration Endpoint

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2025-59716 has been observed exploited in the wild (reported by VulnCheck KEV). A Nuclei detection template is also available.

Description

ownCloud Guests before 0.12.5 allows unauthenticated user enumeration via the /apps/guests/register/{email}/{token} endpoint. Because of insufficient validation of the supplied token in showPasswordForm, the server responds differently when an e-mail address corresponds to a valid pending guest user rather than a non-existent user.

Nuclei Templates (1)

ownCloud Guests - User Enumeration
MEDIUMVERIFIEDby DhiyaneshDk
Shodan: http.title:"ownCloud"
FOFA: title="ownCloud"

References (4)

Core 4

Scores

CVSS v3 5.3
EPSS 0.0098
EPSS Percentile 77.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact partial

Details

VulnCheck KEV 2026-04-01
CWE
CWE-200 CWE-203
Status published
Products (1)
owncloud/guests < 0.12.4
Published Nov 05, 2025
Tracked Since Feb 18, 2026