4.3
CVE-2025-66556
- EPSS 0.01%
- Veröffentlicht 05.12.2025 17:56:44
- Zuletzt bearbeitet 09.12.2025 16:52:34
- Quelle security-advisories@github.com
- CVE-Watchlists
- Unerledigt
Nextcloud talk allows participants to blindly delete poll drafts of other users by ID
Participants were able to blindly delete poll drafts of other users by ID
Nextcloud talk is a video & audio conferencing app for Nextcloud. Prior to 20.1.8 and 21.1.2, a participant with chat permissions was able to delete poll drafts of other participants within the conversation based on their numeric ID. This vulnerability is fixed in 20.1.8 and 21.1.2.
Mögliche Gegenmaßnahme
Talk: * No workaround available
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. 
Login
LoginWeitere Schwachstelleninformationen
SystemNextcloud App
≫
Produkt
Talk
Version
>= 20.0.0, < 20.1.8
Version
>= 21.0.0, < 21.1.2
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.01% | 0.02 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 4.3 | 2.8 | 1.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
|
| security-advisories@github.com | 3.5 | 2.1 | 1.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
|
CWE-639 Authorization Bypass Through User-Controlled Key
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.