3.5Düşük
CVE-2025-66556Nextcloud talk allows participants to blindly delete poll drafts of other users by ID
Açıklama
Nextcloud talk is a video & audio conferencing app for Nextcloud. Prior to 20.1.8 and 21.1.2, a participant with chat permissions was able to delete poll drafts of other participants within the conversation based on their numeric ID. This vulnerability is fixed in 20.1.8 and 21.1.2.
Zayıflık türü (CWE):
CWE-639
Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.
Etkilenen ürünler ve sürümler
| Üretici | Ürün | Sürümler | |
|---|---|---|---|
| nextcloud | security-advisories | < 20.1.8, >= 21.0.0-beta.1, < 21.1.2 | |
| nextcloud | talk | 20.0.0 – < 20.1.8 |
Kaynaklar ve yamalar
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-pr9f-vqgg-m2jh PatchVendor Advisory
- https://github.com/nextcloud/spreed/pull/15532 Issue TrackingPatch
- https://github.com/nextcloud/spreed/commit/bd68e80d1dea98d84c1d621c2c681238cf041725 Patch
- https://hackerone.com/reports/3247386 Issue TrackingVendor Advisory
CPE eşleşmeleri (NVD) (2)
cpe:2.3:a:nextcloud:talk:*:*:*:*:*:*:*:*≥ 20.0.0 < 20.1.8cpe:2.3:a:nextcloud:talk:*:*:*:*:*:*:*:*≥ 21.0.0 < 21.1.2