Nextcloud talk is a video & audio conferencing app for Nextcloud. Prior to 20.1.8 and 21.1.2, a participant with chat permissions was able to delete poll drafts of other participants within the conversation based on their numeric ID. This vulnerability is fixed in 20.1.8 and 21.1.2.
Fix
Patch, vendor advisory and mitigation references on NVD 4
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-pr9f-vqgg-m2jh Patch, Vendor Advisory
- https://github.com/nextcloud/spreed/commit/bd68e80d1dea98d84c1d621c2c681238cf041725 Patch
- https://github.com/nextcloud/spreed/pull/15532 Issue Tracking, Patch
- https://hackerone.com/reports/3247386 Issue Tracking, Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 4.3 · nextcloudNVD modified 2026-10-15 21:10
Affected (CPE criteria) 1
cpe:2.3:a:nextcloud:talk:*:*:*:*:*:*:*:*
References 4
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-pr9f-vqgg-m2jh Patch, Vendor Advisory
- https://github.com/nextcloud/spreed/commit/bd68e80d1dea98d84c1d621c2c681238cf041725 Patch
- https://github.com/nextcloud/spreed/pull/15532 Issue Tracking, Patch
- https://hackerone.com/reports/3247386 Issue Tracking, Vendor Advisory