EUVD-2025-201458
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
Lifecycle Timeline
4Description
Nextcloud talk is a video & audio conferencing app for Nextcloud. Prior to 20.1.8 and 21.1.2, a participant with chat permissions was able to delete poll drafts of other participants within the conversation based on their numeric ID. This vulnerability is fixed in 20.1.8 and 21.1.2.
Analysis
Nextcloud talk is a video & audio conferencing app for Nextcloud. Prior to 20.1.8 and 21.1.2, a participant with chat permissions was able to delete poll drafts of other participants within the conversation based on their numeric ID. This vulnerability is fixed in 20.1.8 and 21.1.2.
Technical Context
This vulnerability is classified as Authorization Bypass Through User-Controlled Key (CWE-639).
Affected Products
Affected products: Nextcloud Talk
Remediation
A vendor patch is available. Apply it as soon as possible and verify the fix.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today