CVE-2025-66556

Nextcloud talk is a video & audio conferencing app for Nextcloud. Prior to 20.1.8 and 21.1.2, a participant with chat permissions was able to delete poll drafts of other participants within the conversation based on their numeric ID. This vulnerability is fixed in 20.1.8 and 21.1.2.

CVSS v3 3.5 LOW

3.5^/10

CVSS v3 : LOW

Vector :

Exploitability : 2.1 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-pr9f-vqgg-m2jh	Patch Vendor Advisory
https://github.com/nextcloud/spreed/commit/bd68e80d1dea98d84c1d621c2c681238cf041725	Patch
https://github.com/nextcloud/spreed/pull/15532	Issue Tracking Patch
https://hackerone.com/reports/3247386	Issue Tracking Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:nextcloud:talk::::::::
	cpe:2.3:a:nextcloud:talk::::::::

History

15 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Nextcloud Talk es una aplicación de videoconferencia y audio para?Nextcloud.?Versiones anteriores a?20.1.8?y?21.1.2, un participante con permisos de chat podía eliminar borradores de encuestas de otros participantes dentro de la conversación basándose en su identificador numérico.?Esta vulnerabilidad está corregida en?20.1.8?y?21.1.2.

Information

Published : 2025-12-05 18:15

Updated : 2026-10-15 21:10

NVD link : CVE-2025-66556

Mitre link : CVE-2025-66556

CVE.ORG link : CVE-2025-66556

JSON object : View

Products Affected

nextcloud

talk

CWE

CWE-639

Authorization Bypass Through User-Controlled Key

{"id": "CVE-2025-66556", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-66556", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-05T18:08:50.955809Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.5, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.1}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "nextcloud", "product": "security-advisories", "versions": [{"status": "affected", "version": "< 20.1.8"}, {"status": "affected", "version": ">= 21.0.0-beta.1, < 21.1.2"}]}]}], "published": "2025-12-05T18:15:58.803", "references": [{"url": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-pr9f-vqgg-m2jh", "tags": ["Patch", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/nextcloud/spreed/commit/bd68e80d1dea98d84c1d621c2c681238cf041725", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/nextcloud/spreed/pull/15532", "tags": ["Issue Tracking", "Patch"], "source": "security-advisories@github.com"}, {"url": "https://hackerone.com/reports/3247386", "tags": ["Issue Tracking", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-639"}]}], "descriptions": [{"lang": "en", "value": "Nextcloud talk is a video & audio conferencing app for Nextcloud. Prior to 20.1.8 and 21.1.2, a participant with chat permissions was able to delete poll drafts of other participants within the conversation based on their numeric ID. This vulnerability is fixed in 20.1.8 and 21.1.2."}, {"lang": "es", "value": "Nextcloud Talk es una aplicaci\u00f3n de videoconferencia y audio para?Nextcloud.?Versiones anteriores a?20.1.8?y?21.1.2, un participante con permisos de chat pod\u00eda eliminar borradores de encuestas de otros participantes dentro de la conversaci\u00f3n bas\u00e1ndose en su identificador num\u00e9rico.?Esta vulnerabilidad est\u00e1 corregida en?20.1.8?y?21.1.2."}], "lastModified": "2026-10-15T21:10:00.327", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:nextcloud:talk:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5D5909D1-F39C-4C41-906C-2D2A7C830F0A", "versionEndExcluding": "20.1.8", "versionStartIncluding": "20.0.0"}, {"criteria": "cpe:2.3:a:nextcloud:talk:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D2E99EC0-4563-4497-A72C-52C97089F7E1", "versionEndExcluding": "21.1.2", "versionStartIncluding": "21.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}