3.5Niedrig
CVE-2025-66556Nextcloud talk allows participants to blindly delete poll drafts of other users by ID
Beschreibung
Nextcloud talk is a video & audio conferencing app for Nextcloud. Prior to 20.1.8 and 21.1.2, a participant with chat permissions was able to delete poll drafts of other participants within the conversation based on their numeric ID. This vulnerability is fixed in 20.1.8 and 21.1.2.
Schwachstellentyp (CWE):
CWE-639
Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.
Betroffene Produkte und Versionen
| Hersteller | Produkt | Versionen | |
|---|---|---|---|
| nextcloud | security-advisories | < 20.1.8, >= 21.0.0-beta.1, < 21.1.2 | |
| nextcloud | talk | 20.0.0 – < 20.1.8 |
Referenzen und Patches
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-pr9f-vqgg-m2jh PatchVendor Advisory
- https://github.com/nextcloud/spreed/pull/15532 Issue TrackingPatch
- https://github.com/nextcloud/spreed/commit/bd68e80d1dea98d84c1d621c2c681238cf041725 Patch
- https://hackerone.com/reports/3247386 Issue TrackingVendor Advisory
CPE-Treffer (NVD) (2)
cpe:2.3:a:nextcloud:talk:*:*:*:*:*:*:*:*≥ 20.0.0 < 20.1.8cpe:2.3:a:nextcloud:talk:*:*:*:*:*:*:*:*≥ 21.0.0 < 21.1.2