CVE-2025-66556
📋 TL;DR
This vulnerability in Nextcloud Talk allows participants with chat permissions to delete poll drafts created by other participants within the same conversation by exploiting numeric ID enumeration. It affects Nextcloud Talk instances running versions before 20.1.8 and 21.1.2.
💻 Affected Systems
- Nextcloud Talk
📦 What is this software?
Talk by Nextcloud
Talk by Nextcloud
⚠️ Risk & Real-World Impact
Worst Case
Malicious participants could disrupt meeting workflows by deleting important poll drafts, potentially causing confusion or data loss in collaborative sessions.
Likely Case
Participants could delete poll drafts from other users, causing minor disruption to meeting preparation and requiring recreation of polls.
If Mitigated
With proper access controls and monitoring, impact is limited to temporary inconvenience and minor data loss.
🎯 Exploit Status
Exploitation requires authenticated access with chat permissions and knowledge of numeric poll IDs.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 20.1.8 or 21.1.2
Vendor Advisory: https://github.com/nextcloud/security-advisories/security/advisories/GHSA-pr9f-vqgg-m2jh
Restart Required: No
Instructions:
1. Update Nextcloud Talk to version 20.1.8 (for Nextcloud 20) or 21.1.2 (for Nextcloud 21). 2. Verify the update completed successfully. 3. No service restart required.
🔧 Temporary Workarounds
Restrict chat permissions
allTemporarily limit chat permissions to trusted users only to reduce attack surface.
Disable poll feature
allTemporarily disable poll functionality in Nextcloud Talk settings.
🧯 If You Can't Patch
- Implement strict access controls to limit chat permissions to essential users only.
- Monitor audit logs for unusual poll deletion activities and implement alerting.
🔍 How to Verify
Check if Vulnerable:
Check Nextcloud Talk version in Nextcloud admin settings. If version is below 20.1.8 (for Nextcloud 20) or below 21.1.2 (for Nextcloud 21), the system is vulnerable.Check Version:
Check via Nextcloud web interface: Admin → Apps → Installed apps → Nextcloud TalkVerify Fix Applied:
Verify Nextcloud Talk version is 20.1.8 or higher (for Nextcloud 20) or 21.1.2 or higher (for Nextcloud 21) in admin settings.📡 Detection & Monitoring
Log Indicators:
- Unusual poll deletion events in Nextcloud audit logs
- Multiple poll deletions from same user in short timeframe
Network Indicators:
- HTTP requests to poll deletion endpoints with unauthorized user IDs
SIEM Query:
source="nextcloud" AND event="poll_deleted" AND user_id!=owner_id