{"id":"CVE-2026-45266","aliases":["EUVD-2026-33678","GHSA-x75r-65hm-cw35"],"status":"published","title":"Nextcloud: Unauthorized force-mute from missing permission check when using internal signaling","description":"Nextcloud is an open source content collaboration platform. Prior to versions 21.1.10, 22.0.11, and 23.0.3, a low-privileged user can force other user's microphones to be muted in calls when no High-performance Backend is installed. This issue has been patched in versions 21.1.10, 22.0.11, and 23.0.3.","severity":{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00203,"percentile":0.10301,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-284"],"published":"2026-06-01T16:39:56Z","modified":"2026-10-28T02:30:59Z","products":[{"vendor":"kiteworks","product":"security-advisories"},{"vendor":"nextcloud","product":"security-advisories"}],"references":[{"url":"https://github.com/nextcloud/security-advisories/security/advisories/GHSA-x75r-65hm-cw35","tags":["x_refsource_CONFIRM","advisory"]},{"url":"https://github.com/nextcloud/spreed/pull/17577","tags":["x_refsource_MISC","fix"]},{"url":"https://hackerone.com/reports/3636758","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45266.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45266","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-45266","title":"Nextcloud: Unauthorized force-mute from missing permission check when using internal signaling","description":"Nextcloud is an open source content collaboration platform. Prior to versions 21.1.10, 22.0.11, and 23.0.3, a low-privileged user can force other user's microphones to be muted in calls when no High-performance Backend is installed. This issue has been patched in versions 21.1.10, 22.0.11, and 23.0.3.","status":"published","published":"2026-06-01T16:39:56.879Z","modified":"2026-06-01T17:40:19.878Z","cvss":[{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N","level":"low","assessor":"cna"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T13:46:43.922571Z"}],"euvd":[{"id":"EUVD-2026-33678","description":"Nextcloud is an open source content collaboration platform. Prior to versions 21.1.10, 22.0.11, and 23.0.3, a low-privileged user can force other user's microphones to be muted in calls when no High-performance Backend is installed. This issue has been patched in versions 21.1.10, 22.0.11, and 23.0.3.","status":"published","published":"2026-06-01T16:39:56Z","modified":"2026-06-01T17:40:19Z","cvss":[{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T18:20:57.828765Z"}],"nvd":[{"id":"CVE-2026-45266","description":"Nextcloud is an open source content collaboration platform. Prior to versions 21.1.10, 22.0.11, and 23.0.3, a low-privileged user can force other user's microphones to be muted in calls when no High-performance Backend is installed. This issue has been patched in versions 21.1.10, 22.0.11, and 23.0.3.","status":"published","published":"2026-06-01T17:17:09.827Z","modified":"2026-07-22T07:10:00.107Z","cvss":[{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N","level":"low","assessor":"secondary"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:12:21.635958Z"}],"osv":[{"id":"CVE-2026-45266","title":"Nextcloud: Unauthorized force-mute from missing permission check when using internal signaling","description":"Nextcloud is an open source content collaboration platform. Prior to versions 21.1.10, 22.0.11, and 23.0.3, a low-privileged user can force other user's microphones to be muted in calls when no High-performance Backend is installed. This issue has been patched in versions 21.1.10, 22.0.11, and 23.0.3.","status":"published","published":"2026-06-01T16:39:56.879Z","modified":"2026-10-28T02:30:59.741921078Z","cvss":[{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N","level":"low"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T15:45:05.172514Z"}]}}