CVEvulnerability

CVE-2025-66556

4.3 MEDIUM Published 2025-12-05 Modified 2026-10-15 Official page ↗
Status
Analyzed
Published
2025-12-05
Last modified
2026-10-15
Assigner
[email protected]
CVSS 3.1 ([email protected])
3.5 LOW — CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
CVSS 3.1 ([email protected])
4.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-639

Description

Nextcloud talk is a video & audio conferencing app for Nextcloud. Prior to 20.1.8 and 21.1.2, a participant with chat permissions was able to delete poll drafts of other participants within the conversation based on their numeric ID. This vulnerability is fixed in 20.1.8 and 21.1.2.

Affected configurations

• nextcloud talk (>= 20.0.0 < 20.1.8) • nextcloud talk (>= 21.0.0 < 21.1.2)

Related

Weakness · CWE (1)

  • CWE-639 Authorization Bypass Through User-Controlled Key weakness

References