CVE-2025-66556: nextcloud talk

csirt@kutim:~/threat-intel/cve/CVE-2025-66556

CVSS 4.3 · Medium EPSS 0,25%

Kerentanan Authorization Bypass Through User-Controlled Key pada nextcloud talk. Skor CVSS 3.1 4.3 (Medium) menurut NVD.

Deskripsi (NVD)

Nextcloud talk is a video & audio conferencing app for Nextcloud. Prior to 20.1.8 and 21.1.2, a participant with chat permissions was able to delete poll drafts of other participants within the conversation based on their numeric ID. This vulnerability is fixed in 20.1.8 and 21.1.2.

Rincian

Terbit di NVD: 5 Desember 2025
Terakhir diubah: 17 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 4.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-639: Authorization Bypass Through User-Controlled Key
EPSS (30 hari): 0,25% peluang dieksploitasi; lebih tinggi dari 15,6% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
nextcloud	talk	Versi 20.0.0 hingga sebelum 20.1.8
nextcloud	talk	Versi 21.0.0 hingga sebelum 21.1.2

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-pr9f-vqgg-m2jh patch · advisory vendor
https://hackerone.com/reports/3247386 issue tracking · advisory vendor
https://github.com/nextcloud/spreed/commit/bd68e80d1dea98d84c1d621c2c681238cf041725 patch
https://github.com/nextcloud/spreed/pull/15532 issue tracking · patch

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.