{"cvss":5.3,"datePublished":"2026-04-01T00:00:00Z","dateUpdated":"2026-04-01T00:00:00Z","description":"ownCloud Guests before 0.12.5 allows unauthenticated user enumeration via the /apps/guests/register/{email}/{token} endpoint. Because of insufficient validation of the supplied token in showPasswordForm, the server responds differently when an e-mail address corresponds to a valid pending guest user rather than a non-existent user.","dueDate":"","id":"CVE-2025-59716","kev_catalogs":["vulncheck"],"knownRansomwareCampaignUse":"Unknown","product":"guests","requiredAction":"Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.","severity":"MEDIUM","source":"vulncheck_kev","title":"ownCloud guests Exposure of Sensitive Information to an Unauthorized Actor","vendor":"ownCloud"}