CVE-2025-66556 Nextcloud talk allows participants to blindly delete poll drafts of other users by ID
A participant can delete other users' poll drafts by guessing IDs, allowing unauthorized data modification in Nextcloud Talk.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2025-66556?
CVE-2025-66556 is a low-severity missing authorization vulnerability in nextcloud security-advisories, published on 5 Dec 2025. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Nextcloud talk is a video & audio conferencing app for Nextcloud. Prior to 20.1.8 and 21.1.2, a participant with chat permissions was able to delete poll drafts of other participants within the conversation based on their numeric ID. This vulnerability is fixed in 20.1.8 and 21.1.2.
Weakness: CWE-639
Which versions are affected by CVE-2025-66556?
It affects 1 product.
Products include Nextcloud Talk.
How do I fix CVE-2025-66556?
No fix has been published for CVE-2025-66556 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2025-66556 being exploited?
There is no known exploitation of CVE-2025-66556 in the wild and no public exploit code.
Other vulnerabilities in nextcloud security-advisories
- CVE-2020-8180 Code injection in Nextcloud Talk
- CVE-2021-32689 Nextcloud Talk not properly disassociating users from chats after account deletion
- CVE-2023-39957 Path traversal allows tricking the Talk Android app into writing files into it's root directory
- CVE-2021-32676 Session Fixation in Nextcloud Talk
- CVE-2021-39222 XSS in Talk
Sources
Also known as GHSA-pr9f-vqgg-m2jh.