CVE-2025-66556

Nextcloud talk is a video & audio conferencing app for Nextcloud. Prior to 20.1.8 and 21.1.2, a participant with chat permissions was able to delete poll drafts of other participants within the conversation based on their numeric ID. This vulnerability is fixed in 20.1.8 and 21.1.2.

CVSS 3.1

4.3CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

EPSS

0.3% chance of exploitation in the next 30 days; higher than 16% of CVEs (scores of 2026-10-25)

CWE

CWE-639

Published

2025-12-05

Modified

2026-10-15

Record from

the NVD, synced 2026-10-19

Affected

• nextcloud:talk

References

• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-pr9f-vqgg-m2jh
• https://github.com/nextcloud/spreed/commit/bd68e80d1dea98d84c1d621c2c681238cf041725
• https://github.com/nextcloud/spreed/pull/15532
• https://hackerone.com/reports/3247386

Check your stackJSON