Skip to content
CVE PROGRAM SOURCE RECORD3.5 Low

CVE-2026-45266

Nextcloud: Unauthorized force-mute from missing permission check when using internal signaling

Description

Nextcloud is an open source content collaboration platform. Prior to versions 21.1.10, 22.0.11, and 23.0.3, a low-privileged user can force other user's microphones to be muted in calls when no High-performance Backend is installed. This issue has been patched in versions 21.1.10, 22.0.11, and 23.0.3.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

nextcloud security-advisories

  • < 21.1.10affected
  • < 22.0.11affected
  • < 23.0.3affected

References