CVE-2021-32689 Nextcloud Talk not properly disassociating users from chats after account deletion
Attackers can read previous users' chat messages by reusing deleted usernames if self-registration is enabled.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-32689?
CVE-2021-32689 is a high-severity missing authorization vulnerability in nextcloud security-advisories, published on 12 Jul 2021. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Nextcloud Talk is a fully on-premises audio/video and chat communication service. In versions prior to 11.2.2, if a user was able to reuse an earlier used username, they could get access to any chat message sent to the previous user with this username. The issue was patched in versions 11.2.2 and 11.3.0. As a workaround, don't allow users to choose usernames themselves. This is the default behaviour of Nextcloud, but some user providers may allow doing so.
Which versions are affected by CVE-2021-32689?
It affects 1 product.
Products include Nextcloud Talk.
How do I fix CVE-2021-32689?
No fix has been published for CVE-2021-32689 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2021-32689 being exploited?
There is no known exploitation of CVE-2021-32689 in the wild and no public exploit code.
Other vulnerabilities in nextcloud security-advisories
Sources
Also known as GHSA-xv6f-344w-895c.