Executive brief
Nextcloud Talk is a communication platform used for video calls and chat within organizations. A vulnerability in the platform's internal signaling system allows a user with low-level access to remotely mute the microphones of other participants in a call. This can lead to disruption of meetings and unauthorized control over the communication environment.
Technical details
An improper access control vulnerability (CWE-284) exists in Nextcloud Talk (Spreed) when using the internal signaling backend. The root cause is a missing permission check in the signaling component that fails to verify if the sender has the authority to mute other recipients in a room. An authenticated, low-privileged attacker can exploit this over the network to mute other users' microphones. This vulnerability specifically affects installations where the 'High-performance Backend' is not in use. The issue has been addressed by implementing recipient room validation in the signaling logic.
Affected products
- Nextcloud Talk (Spreed) < 21.1.10, < 22.0.11, < 23.0.3
Timeline
- 2026-04-01: patched: Fix merged into main repository
- 2026-05-12: advisory: Vendor security advisory published
- 2026-06-01: disclosed: CVE published to NVD