Talk

CVE-2025-66556 Dec 05, 18:15 MEDIUM PATCH This Month

An authorization bypass in the Nextcloud Talk conferencing app (spreed) lets an authenticated conversation participant who holds chat permissions delete other participants' poll drafts by supplying the draft's numeric ID, because the poll controller never verified moderator or ownership rights before acting on that identifier. The flaw affects Talk versions prior to 20.1.8 and the 21.0.0-beta.1 through 21.1.2 range, and is rated CVSS 4.3 (network reachable, low privileges required, integrity-only impact) with an EPSS score of just 0.01% (2nd percentile), indicating a low-likelihood, low-priority issue. No public exploit code has been identified at the time of analysis, and CISA KEV does not list this CVE; vendor-released patches (20.1.8 and 21.1.2) are available.

CVE-2023-45149 Oct 16, 20:15 MEDIUM PATCH This Month

Nextcloud talk is a chat module for the Nextcloud server platform. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity.

CVE-2023-39957 Aug 10, 16:15 HIGH PATCH This Week

Nextcloud Talk Android allows users to place video and audio calls through Nextcloud on Android. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.

CVE-2023-30540 Apr 17, 22:15 MEDIUM PATCH This Month

Nextcloud Talk is a chat, video & audio call extension for Nextcloud. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.

CVE-2023-28845 Mar 31, 23:15 LOW PATCH Monitor

Nextcloud talk is a video & audio conferencing app for Nextcloud. Rated low severity (CVSS 3.5), this vulnerability is remotely exploitable, low attack complexity.

CVE-2023-22473 Jan 09, 15:15 LOW POC PATCH Monitor

Talk-Android enables users to have video & audio calls through Nextcloud on Android. Rated low severity (CVSS 2.1), this vulnerability is no authentication required, low attack complexity. Public exploit code available.

CVE-2022-41926 Nov 25, 19:15 MEDIUM PATCH This Month

Nextcould talk android is the android OS implementation of the nextcloud talk chat system. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.

CVE-2022-39212 Sep 17, 00:15 MEDIUM PATCH This Month

Nextcloud Talk is an open source chat, video & audio calls client for the Nextcloud platform. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.

CVE-2022-35932 Aug 12, 16:15 MEDIUM PATCH This Month

Nextcloud Talk is a video and audio conferencing app for Nextcloud. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2022-24890 May 17, 19:15 MEDIUM POC PATCH This Month

Nextcloud Talk is a video and audio conferencing app for Nextcloud. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.

CVE-2022-24887 Apr 27, 14:15 MEDIUM POC PATCH This Month

Nextcloud Talk is a video and audio conferencing app for Nextcloud, a self-hosted productivity platform. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

CVE-2021-39222 Nov 15, 19:15 MEDIUM This Month

Nextcloud is an open-source, self-hosted productivity platform. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2021-32689 Jul 12, 19:15 MEDIUM PATCH This Month

Nextcloud Talk is a fully on-premises audio/video and chat communication service. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.

CVE-2021-32676 Jun 16, 00:15 MEDIUM This Month

Nextcloud Talk is a fully on-premises audio/video and chat communication service. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

CVE-2020-8180 Jun 08, 14:15 CRITICAL POC Act Now

A too lax check in Nextcloud Talk 6.0.4, 7.0.2 and 8.0.7 allowed a code injection when a not correctly sanitized talk command was added by an administrator. Rated critical severity (CVSS 9.9), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2018-3781 Aug 13, 19:29 MEDIUM This Month

A missing sanitization of search results for an autocomplete field in NextCloud Talk <3.2.5 could lead to a stored XSS requiring user-interaction. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.