3.5Baja
CVE-2025-66556Nextcloud talk allows participants to blindly delete poll drafts of other users by ID
Descripción
Nextcloud talk is a video & audio conferencing app for Nextcloud. Prior to 20.1.8 and 21.1.2, a participant with chat permissions was able to delete poll drafts of other participants within the conversation based on their numeric ID. This vulnerability is fixed in 20.1.8 and 21.1.2.
Debilidad (CWE):
CWE-639
Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.
Productos y versiones afectados
| Fabricante | Producto | Versiones | |
|---|---|---|---|
| nextcloud | security-advisories | < 20.1.8, >= 21.0.0-beta.1, < 21.1.2 | |
| nextcloud | talk | 20.0.0 – < 20.1.8 |
Referencias y parches
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-pr9f-vqgg-m2jh PatchVendor Advisory
- https://github.com/nextcloud/spreed/pull/15532 Issue TrackingPatch
- https://github.com/nextcloud/spreed/commit/bd68e80d1dea98d84c1d621c2c681238cf041725 Patch
- https://hackerone.com/reports/3247386 Issue TrackingVendor Advisory
Coincidencias CPE (NVD) (2)
cpe:2.3:a:nextcloud:talk:*:*:*:*:*:*:*:*≥ 20.0.0 < 20.1.8cpe:2.3:a:nextcloud:talk:*:*:*:*:*:*:*:*≥ 21.0.0 < 21.1.2