The vulnerability allows an authenticated Nextcloud user to retrieve a list of other user identifiers through the Calendar app’s attendee suggestion API. This is an information‑disclosure flaw (CWE‑200) that enables enumeration of all users on the same Nextcloud instance, potentially giving an attacker insight into the user base and facilitating further social‑engineering or targeted attacks. The flaw does not provide direct access to user data or configuration but exposes enough information to be exploited in lateral movement or phishing campaigns.

Nextcloud Calendar app, versions 5.5.13 through 5.5.16 and 6.2.0 through 6.2.2. The issue was fixed in version 5.5.17 and in 6.2.3. No other versions are known to be affected.

The CVSS score of 4.3 indicates a moderate severity, reflecting that the attacker must be authenticated to use the endpoint. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting lower likelihood of widespread exploitation. However, because the flaw allows enumeration of user identities on the same instance, it poses a meaningful threat for privileged or compromised accounts, particularly in environments with many users or where user data is sensitive.