Skip to content
OpenAdvisories
Low · 3.5 CVE-2026-45266 EUVD-2026-33678

Nextcloud: Unauthorized force-mute from missing permission check when using internal signaling

Published Jun 1, 2026 · Updated Jun 1, 2026 · Assigned by GitHub_M

Description

Nextcloud is an open source content collaboration platform. Prior to versions 21.1.10, 22.0.11, and 23.0.3, a low-privileged user can force other user's microphones to be muted in calls when no High-performance Backend is installed. This issue has been patched in versions 21.1.10, 22.0.11, and 23.0.3.

Affected products

VendorProductAffectedFixed
nextcloud security-advisories < 21.1.10, < 22.0.11, < 23.0.3 —

Advisories 1

References