CVE-2025-66556 LOW

CVE-2025-66556: Nextcloud talk allows participants to blindly delete poll drafts of other users by ID

Vendor Nextcloud
Product security-advisories
Weakness CWE-639 · IDOR
Published December 5, 2025
Last update December 5, 2025
View on NVD All CVEs

CVSS base score

3.5/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction Required
Confidentiality None
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

What the vulnerability does

01Description

Nextcloud talk is a video & audio conferencing app for Nextcloud. Prior to 20.1.8 and 21.1.2, a participant with chat permissions was able to delete poll drafts of other participants within the conversation based on their numeric ID. This vulnerability is fixed in 20.1.8 and 21.1.2.

Key dates

02Disclosure timeline

December 5, 2025 CVE published
December 5, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-1469 IDOR in Turtek Software's Eyotek CVE-2024-2576 SourceCodester Employee Task Management System update-admin.php authorization CVE-2025-57994 WordPress Upcoming Events Lists Plugin <= 1.4.0 - Insecure Direct Object References (IDOR) Vulnerability CVE-2026-5465 Amelia <= 2.1.3 - Insecure Direct Object Reference to Authenticated (Employee+) Privilege Escalation via 'externalId' Parameter CVE-2025-6038 Lisfinity Core - Lisfinity Core plugin used for pebas® Lisfinity WordPress theme <= 1.4.0 - Authenticated (Subscriber+) Privilege Escalation