What’s Vulnerable › Vulnerabilities

CVE-2022-24890: Exposure of Private Personal Information to an Unauthorized Actor in Nextcloud Talk

• Severity: medium (CVSS 4.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-05-17 · updated 2026-06-17
• Weakness: CWE-200

Description

Nextcloud Talk is a video and audio conferencing app for Nextcloud. In versions prior to 13.0.5 and 14.0.0, a call moderator can indirectly enable user webcams by granting permissions, if they were enabled before removing the permissions. A patch is available in versions 13.0.5 and 14.0.0. There are currently no known workarounds.

Affected products

• Nextcloud Talk: before 13.0.5; 14.0.0-beta1, 14.0.0-rc1, 14.0.0-rc2, 14.0.0-rc3, 14.0.0-rc4 — fixed in 13.0.5

How to fix

Upgrade to a fixed version: Nextcloud Talk 13.0.5. Check the vendor advisory for mitigations.

References

• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-vxpr-hcqq-7fw7
• https://github.com/nextcloud/spreed/issues/7048
• https://github.com/nextcloud/spreed/pull/7034
• https://github.com/nextcloud/spreed/pull/7092
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-vxpr-hcqq-7fw7
• https://github.com/nextcloud/spreed/issues/7048
• https://github.com/nextcloud/spreed/pull/7034
• https://github.com/nextcloud/spreed/pull/7092

Get alerted when CVE-2022-24890 or the next vulnerability affects your stack