Listen to this Post
The CVE-2025-66556 vulnerability in Nextcloud Talk arises from inadequate authorization checks in the poll draft deletion functionality. Nextcloud Talk is a collaborative video and audio conferencing application integrated into Nextcloud servers. Within conversations, users with chat permissions can create and manage polls, including drafting them before publication. Each poll draft is assigned a unique numeric ID for identification in the system. The vulnerability allows any participant who has chat permissions in a conversation to delete poll drafts belonging to other participants by manipulating these numeric IDs. This occurs because the application fails to verify whether the user requesting the deletion is the owner of the poll draft or has appropriate administrative rights. The deletion request typically involves sending a specific API call or web request to the server endpoint handling poll operations. Attackers can exploit this by crafting HTTP requests, such as DELETE methods, targeting the poll draft IDs of other users. The server processes these requests without validating user ownership, leading to unauthorized deletions. This flaw is present in Nextcloud Talk versions prior to 20.1.8 for the 20.x branch and prior to 21.1.2 for the 21.x branch. The issue stems from missing server-side checks that should enforce user-based access controls on poll draft resources. As a result, malicious participants can disrupt meetings or collaborations by deleting unpublished poll data. The vulnerability does not require elevated privileges beyond standard chat permissions, making it accessible to regular conversation members. It primarily affects the integrity of poll data, causing loss of work and potential confusion in communication. The fixed versions, 20.1.8 and 21.1.2, address this by implementing proper authorization routines that ensure only draft owners or authorized users can delete polls. This patch involves validating user sessions and poll ownership before executing deletion commands. The vulnerability was responsibly disclosed and patched, highlighting the importance of access control in collaborative web applications.
Platform: Nextcloud Talk
Version: Before 20.1.8 21.1.2
Vulnerability: Unauthorized draft deletion
Severity: Medium
Date: December 5, 2025
Prediction: Patch released December 2025
What Undercode Say:
Analytics
bash
Check Nextcloud Talk version
php occ app:getinfo spreed
List installed apps
php occ app:list
Verify server status
php occ status
codes
// Sample vulnerable endpoint pattern (illustrative)
DELETE /apps/spreed/api/v1/poll/{id}
// Authorization check missing in code
if (!user_owns_poll($id)) { // This check was absent
delete_poll($id);
}
How Exploit:
Send DELETE request to poll draft endpoint with another user’s numeric ID without authorization.
Protection from this CVE
Update to Nextcloud Talk versions 20.1.8 or 21.1.2.
Impact:
Unauthorized poll deletion, data loss, meeting disruption.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
