What is the CVSS score of EUVD-2026-33678?

EUVD-2026-33678 has a CVSS 3.1 base score of 3.5 (Low). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for EUVD-2026-33678?

Yes, a patch is available for EUVD-2026-33678. Update the affected software to the latest version immediately.

Nextcloud Talk EUVD-2026-33678

| CVE-2026-45266 LOW

Improper Access Control (CWE-284)

2026-06-01 GitHub_M

Authentication Bypass Nextcloud

3.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

3.5 LOW

AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Patch available

Jun 01, 2026 - 18:01 EUVD

Source Code Evidence Fetched

Jun 01, 2026 - 17:20 vuln.today

Analysis Generated

Jun 01, 2026 - 17:20 vuln.today

DescriptionGitHub Advisory

Nextcloud is an open source content collaboration platform. Prior to versions 21.1.10, 22.0.11, and 23.0.3, a low-privileged user can force other user's microphones to be muted in calls when no High-performance Backend is installed. This issue has been patched in versions 21.1.10, 22.0.11, and 23.0.3.

AnalysisAI

Improper access control in Nextcloud Talk's signaling layer allows a low-privileged authenticated user to forcibly mute other participants' microphones during calls on deployments without the High-performance Backend. The vulnerability exists in SignalingController::sendMessages(), which processed 'control' type signaling messages without first validating that the target session (decodedMessage['to']) was a legitimate room participant - allowing session-targeted control commands to reach arbitrary users. No public exploit or CISA KEV listing exists at time of analysis, and real-world impact is limited to call disruption with no data exposure.

Technical ContextAI

The affected component is the Nextcloud Talk application (internally named 'spreed'), which implements WebRTC-based calling using a server-side signaling controller. The vulnerable code in lib/Controller/SignalingController.php processes signaling messages via sendMessages(), routing 'control' message types between session participants. CWE-284 (Improper Access Control) applies: the original code validated the sender's session but failed to verify that decodedMessage['to'] - the target session - actually belonged to a participant in the same room before forwarding control commands. The fix introduces a getParticipantBySession() lookup for the target session and aborts message processing if the target is not a valid room participant. The vulnerability is conditional on the absence of the High-performance Backend (HPB), which implements its own signaling validation layer. CPE: cpe:2.3:a:nextcloud:security-advisories:*:*:*:*:*:*:*:*.

RemediationAI

Upgrade Nextcloud to one of the patched releases: 21.1.10, 22.0.11, or 23.0.3, as confirmed by vendor advisory GHSA-x75r-65hm-cw35 (https://github.com/nextcloud/security-advisories/security/advisories/GHSA-x75r-65hm-cw35). The upstream code fix is merged in nextcloud/spreed PR #17577 (https://github.com/nextcloud/spreed/pull/17577). As an interim compensating control, deploying the Nextcloud Talk High-performance Backend (HPB) eliminates the vulnerable signaling path entirely, since HPB enforces its own participant validation - however, HPB introduces infrastructure overhead and requires additional configuration. Restricting call participation to trusted users via Nextcloud's permission system reduces exposure but does not fully remediate the flaw, as any low-privileged participant can exploit it.