Nextcloud Calendar Participant Token Generation Vulnerability in Meeting Proposals

A vulnerability exists in the Nextcloud Calendar app, specifically in versions 6.0.0 prior to 6.0.3. The issue arises because the app generates participant tokens for meeting proposals using a predictable hash function. This allows an attacker to calculate valid tokens, enabling them to request details and propose dates in meetings. The vulnerability is rooted in the tokens not being randomly generated.

Impact

Exploitation of this vulnerability allows for the manipulation of meeting proposals by computing valid participant tokens, which could be used to request proposal details and submit dates.

Remediation

Users are advised to update the Nextcloud Calendar app to version 6.0.3. If an immediate update is not possible, the Calendar app can be disabled as a temporary workaround.