The vulnerability is the /apps/tables/share/table/{tableId} endpoint in Nextcloud Tables that returns the full list of share recipients and permission levels without checking that the caller has manage‑level access. A user with only read‑data rights can exploit this by making a GET request, thereby learning who the table is shared with and their privileges. This does not reveal the table contents itself but provides insight into collaboration relationships, potentially aiding social engineering or further attacks.

Nextcloud Tables. No specific version range is given in the CVE, so all installations of the app are potentially impacted until the issue is fixed.

The CVSS base score of 3.3 signals a low impact. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an internal or compromised user having read‑data permission on a table and being able to issue an authenticated GET request to the endpoint. While the vulnerability is limited to disclosure of share metadata, it requires legitimate credentials, making it less attractive for external attackers.