Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-45266: Nextcloud users can be forced to mute microphone

CVE-2026-45266 · published 5 months ago

Summary

In older versions of Nextcloud, a regular user could mute another participant's microphone during a call when a certain optional component was not installed. This could disrupt meetings and give the muting user control they shouldn't have. Update Nextcloud to version 21.1.10, 22.0.11, 23.0.3 or later to stop this behavior.

Original advisory text

Nextcloud: Unauthorized force-mute from missing permission check when using internal signaling

Nextcloud is an open source content collaboration platform. Prior to versions 21.1.10, 22.0.11, and 23.0.3, a low-privileged user can force other user's microphones to be muted in calls when no High-performance Backend is installed. This issue has been patched in versions 21.1.10, 22.0.11, and 23.0.3.

References

https://hackerone.com/reports/3636758 URL
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-x75r-6... Vendor Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45266... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-45266 Vendor Advisory
https://github.com/nextcloud/spreed/pull/17577 Patch

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

3.5 Low

Exploitation

<1% chance of attack within 30 days

Type

CWE-284Improper Access Control

Timeline

Published1 Jun 2026

Updated29 Oct 2026

First seen1 Jun 2026

Sources

CVE-2026-45266 · NVD

CVE-2026-45266 · OSV

GHSA-x75r-65hm-cw35 · GHSA

Track software like this

Free during beta