CVE-2026-45266 Overview
CVE-2026-45266 is an improper access control vulnerability [CWE-284] in Nextcloud Talk (the spreed application), an open source content collaboration and conferencing platform. A low-privileged authenticated user can force the microphones of other participants to be muted during calls when no High-performance Backend (HPB) is installed. The flaw affects Nextcloud Talk versions prior to 21.1.10, 22.0.11, and 23.0.3.
Critical Impact
An authenticated participant can disrupt active calls by silencing other users without the moderator privileges normally required for that action.
Affected Products
- Nextcloud Talk (spreed) versions prior to 21.1.10
- Nextcloud Talk (spreed) versions prior to 22.0.11
- Nextcloud Talk (spreed) versions prior to 23.0.3
Discovery Timeline
- 2026-06-01 - CVE-2026-45266 published to NVD
- 2026-06-01 - Last updated in NVD database
Technical Details for CVE-2026-45266
Vulnerability Analysis
The vulnerability resides in the call signaling logic of Nextcloud Talk. When deployments operate without a High-performance Backend, the application relies on its internal signaling path to broadcast participant state changes. The server fails to enforce that only moderators or call organizers can issue mute commands targeting other participants. As a result, a regular call participant with low privileges can submit a state-change request that the backend accepts and propagates to peers.
The issue is categorized under [CWE-284] Improper Access Control. The vendor patched the flaw in versions 21.1.10, 22.0.11, and 23.0.3 of the spreed application.
Root Cause
The root cause is a missing authorization check on the participant-state update endpoint that handles microphone mute actions. The server-side handler trusted the requester's claim to mute another participant without verifying moderator role or ownership. Deployments using an HPB route media events through the external signaling server, which masked the missing check. Without an HPB, the internal signaling pipeline exposes the gap directly.
Attack Vector
Exploitation requires the attacker to hold a valid Nextcloud account and be a participant in a Talk call. The attacker issues an authenticated API request through the standard Talk signaling channel that targets another participant's audio state. The target's client receives the mute event and disables the microphone. Exploitation is limited to environments that do not deploy the High-performance Backend. See the Nextcloud security advisory GHSA-x75r-65hm-cw35 and the spreed pull request #17577 for the corrective code changes.
Detection Methods for CVE-2026-45266
Indicators of Compromise
- Unexpected mute events on participants during calls that do not originate from moderators or self-initiated actions.
- Multiple participant-state change requests from a single low-privileged account targeting other users during active calls.
- User reports of being muted without consent in Talk conversations.
Detection Strategies
- Review Nextcloud Talk and web server access logs for API calls targeting participant state endpoints issued by non-moderator accounts.
- Correlate signaling events with the requester's role at the time of the action to identify role-bypass patterns.
- Audit deployments to confirm whether a High-performance Backend is configured, since affected installations are those without HPB.
Monitoring Recommendations
- Enable verbose logging on the spreed application and forward logs to a centralized SIEM for retention and search.
- Alert on anomalous frequency of participant-state mutations originating from the same session within short time windows.
- Track failed and successful authorization checks introduced by the patched code paths after upgrade.
How to Mitigate CVE-2026-45266
Immediate Actions Required
- Upgrade Nextcloud Talk (spreed) to version 21.1.10, 22.0.11, or 23.0.3, depending on the deployed major branch.
- Audit Talk-enabled Nextcloud servers for HPB presence and prioritize patching instances without a High-performance Backend.
- Review recent call logs for suspicious mute activity initiated by non-moderator accounts.
Patch Information
The vendor released fixes in Nextcloud Talk versions 21.1.10, 22.0.11, and 23.0.3. The patched commits add the missing authorization check on participant mute requests. Technical details are documented in the GitHub Security Advisory GHSA-x75r-65hm-cw35, the spreed pull request #17577, and the HackerOne Report #3636758.
Workarounds
- Deploy a High-performance Backend for Nextcloud Talk, which routes signaling through an external service that is not affected by this code path.
- Restrict Talk usage to trusted user groups until the patched version is installed.
- Limit call participation to authenticated and known internal users while the patch is being rolled out.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
