CVE-2026-45266

Nextcloud is an open source content collaboration platform. Prior to versions 21.1.10, 22.0.11, and 23.0.3, a low-privileged user can force other user's microphones to be muted in calls when no High-performance Backend is installed. This issue has been patched in versions 21.1.10, 22.0.11, and 23.0.3.

CVSS v3 3.5 LOW

3.5^/10

CVSS v3 : LOW

Vector :

Exploitability : 2.1 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-x75r-65hm-cw35
https://github.com/nextcloud/spreed/pull/17577
https://hackerone.com/reports/3636758

Configurations

No configuration.

History

22 Jul 2026, 07:10

Type	Values Removed	Values Added
Summary		(es) Nextcloud es una plataforma de colaboración de contenido de código abierto. Antes de las versiones 21.1.10, 22.0.11 y 23.0.3, un usuario con pocos privilegios puede forzar que los micrófonos de otros usuarios se silencien en las llamadas cuando no hay un Backend de alto rendimiento instalado. Este problema ha sido parcheado en las versiones 21.1.10, 22.0.11 y 23.0.3.

01 Jun 2026, 17:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-06-01 17:17

Updated : 2026-07-22 07:10

NVD link : CVE-2026-45266

Mitre link : CVE-2026-45266

CVE.ORG link : CVE-2026-45266

JSON object : View

Products Affected

No product.

CWE

CWE-284

Improper Access Control

{"id": "CVE-2026-45266", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-45266", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-01T17:35:39.122672Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.5, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.1}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "nextcloud", "product": "security-advisories", "versions": [{"status": "affected", "version": "< 21.1.10"}, {"status": "affected", "version": "< 22.0.11"}, {"status": "affected", "version": "< 23.0.3"}]}]}], "published": "2026-06-01T17:17:09.827", "references": [{"url": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-x75r-65hm-cw35", "source": "security-advisories@github.com"}, {"url": "https://github.com/nextcloud/spreed/pull/17577", "source": "security-advisories@github.com"}, {"url": "https://hackerone.com/reports/3636758", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-284"}]}], "descriptions": [{"lang": "en", "value": "Nextcloud is an open source content collaboration platform. Prior to versions 21.1.10, 22.0.11, and 23.0.3, a low-privileged user can force other user's microphones to be muted in calls when no High-performance Backend is installed. This issue has been patched in versions 21.1.10, 22.0.11, and 23.0.3."}, {"lang": "es", "value": "Nextcloud es una plataforma de colaboraci\u00f3n de contenido de c\u00f3digo abierto. Antes de las versiones 21.1.10, 22.0.11 y 23.0.3, un usuario con pocos privilegios puede forzar que los micr\u00f3fonos de otros usuarios se silencien en las llamadas cuando no hay un Backend de alto rendimiento instalado. Este problema ha sido parcheado en las versiones 21.1.10, 22.0.11 y 23.0.3."}], "lastModified": "2026-07-22T07:10:00.107", "sourceIdentifier": "security-advisories@github.com"}