CVE-2025-59716: guests · n/a
Affects guestsSource CVE Database V5
Not known to be exploited · public detection template (Nuclei) · CVSS 5.3 Medium : upgrade to 0.12.5 when convenient.
Data as of 26 Oct 2026, 06:26 UTC
- EPSS
- 0.9% chance of exploitation in 30 days – higher than 61% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in 0.12.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NExploitation evidence
Disclosed: evidence found.
CVE published 5 Nov 2025
Detectable: evidence found.
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-26.
What to do
Upgrade owncloud/guests to 0.12.5.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
GitHubowncloud/guestspkg:github/owncloud/guestsOther threats | Affected
| Fixed in
|
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
To mitigate CVE-2025-59716, European organizations should: 1) Upgrade ownCloud Guests to version 0.12.5 or later where the vulnerability is fixed. 2) If immediate patching is not feasible, implement web application firewall (WAF) rules to detect and block suspicious requests targeting the /apps/guests/register/{email}/{token} endpoint, especially those exhibiting enumeration patterns. 3) Monitor web server logs for repeated requests with varying email addresses to identify potential enumeration attempts. 4) Enforce strong email verification and multi-factor authentication (MFA) for guest users to reduce the impact of compromised credentials. 5) Educate users about phishing risks and encourage vigilance against unsolicited emails. 6) Limit exposure of the guest registration endpoint by restricting access via network segmentation or VPN where possible. 7) Regularly review and audit guest user accounts to remove stale or unused entries, minimizing the attack surface. These targeted measures go beyond generic advice by focusing on detection, access control, and user awareness specific to this vulnerability and the ownCloud Guests environment.
Description
ownCloud Guests before 0.12.5 allows unauthenticated user enumeration via the /apps/guests/register/{email}/{token} endpoint. Because of insufficient validation of the supplied token in showPasswordForm, the server responds differently when an e-mail address corresponds to a valid pending guest user rather than a non-existent user.