CVE-2026-45266

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-45266", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-11T18:41:13.156Z", "datePublished": "2026-06-01T16:39:56.879Z", "dateUpdated": "2026-06-01T17:40:19.878Z"}, "containers": {"cna": {"title": "Nextcloud: Unauthorized force-mute from missing permission check when using internal signaling", "problemTypes": [{"descriptions": [{"cweId": "CWE-284", "lang": "en", "description": "CWE-284: Improper Access Control", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.5, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-x75r-65hm-cw35", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-x75r-65hm-cw35"}, {"name": "https://github.com/nextcloud/spreed/pull/17577", "tags": ["x_refsource_MISC"], "url": "https://github.com/nextcloud/spreed/pull/17577"}, {"name": "https://hackerone.com/reports/3636758", "tags": ["x_refsource_MISC"], "url": "https://hackerone.com/reports/3636758"}], "affected": [{"vendor": "nextcloud", "product": "security-advisories", "versions": [{"version": "< 21.1.10", "status": "affected"}, {"version": "< 22.0.11", "status": "affected"}, {"version": "< 23.0.3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-01T16:39:56.879Z"}, "descriptions": [{"lang": "en", "value": "Nextcloud is an open source content collaboration platform. Prior to versions 21.1.10, 22.0.11, and 23.0.3, a low-privileged user can force other user's microphones to be muted in calls when no High-performance Backend is installed. This issue has been patched in versions 21.1.10, 22.0.11, and 23.0.3."}], "source": {"advisory": "GHSA-x75r-65hm-cw35", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-01T17:35:39.122672Z", "id": "CVE-2026-45266", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-01T17:40:19.878Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-45266", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-01T17:35:39.122672Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-01T17:40:15.423Z"}}], "cna": {"title": "Nextcloud: Unauthorized force-mute from missing permission check when using internal signaling", "source": {"advisory": "GHSA-x75r-65hm-cw35", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.5, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "nextcloud", "product": "security-advisories", "versions": [{"status": "affected", "version": "< 21.1.10"}, {"status": "affected", "version": "< 22.0.11"}, {"status": "affected", "version": "< 23.0.3"}]}], "references": [{"url": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-x75r-65hm-cw35", "name": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-x75r-65hm-cw35", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/nextcloud/spreed/pull/17577", "name": "https://github.com/nextcloud/spreed/pull/17577", "tags": ["x_refsource_MISC"]}, {"url": "https://hackerone.com/reports/3636758", "name": "https://hackerone.com/reports/3636758", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Nextcloud is an open source content collaboration platform. Prior to versions 21.1.10, 22.0.11, and 23.0.3, a low-privileged user can force other user's microphones to be muted in calls when no High-performance Backend is installed. This issue has been patched in versions 21.1.10, 22.0.11, and 23.0.3."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-284", "description": "CWE-284: Improper Access Control"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-01T16:39:56.879Z"}}}, "cveMetadata": {"cveId": "CVE-2026-45266", "state": "PUBLISHED", "dateUpdated": "2026-06-01T17:40:19.878Z", "dateReserved": "2026-05-11T18:41:13.156Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-06-01T16:39:56.879Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "security-advisories", "vendor": "nextcloud", "versions": [{"status": "affected", "version": "< 21.1.10"}, {"status": "affected", "version": "< 22.0.11"}, {"status": "affected", "version": "< 23.0.3"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Nextcloud is an open source content collaboration platform. Prior to versions 21.1.10, 22.0.11, and 23.0.3, a low-privileged user can force other user's microphones to be muted in calls when no High-performance Backend is installed. This issue has been patched in versions 21.1.10, 22.0.11, and 23.0.3."}, {"lang": "es", "value": "Nextcloud es una plataforma de colaboraci\u00f3n de contenido de c\u00f3digo abierto. Antes de las versiones 21.1.10, 22.0.11 y 23.0.3, un usuario con pocos privilegios puede forzar que los micr\u00f3fonos de otros usuarios se silencien en las llamadas cuando no hay un Backend de alto rendimiento instalado. Este problema ha sido parcheado en las versiones 21.1.10, 22.0.11 y 23.0.3."}], "id": "CVE-2026-45266", "lastModified": "2026-07-22T07:10:00.107", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.5, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.1, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-45266", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-01T17:35:39.122672Z", "version": "2.0.3"}}]}, "published": "2026-06-01T17:17:09.827", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-x75r-65hm-cw35"}, {"source": "security-advisories@github.com", "url": "https://github.com/nextcloud/spreed/pull/17577"}, {"source": "security-advisories@github.com", "url": "https://hackerone.com/reports/3636758"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-284"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,21.1.10)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,22.0.11)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,23.0.3)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "security-advisories", "source": "cna", "vendor": "nextcloud"}, "product": "spreed", "vendor": "nextcloud"}], "created": "2026-06-01T18:45:34.648957+00:00", "updated": "2026-06-02T20:54:00.965330+00:00", "vendors": ["nextcloud", "nextcloud$PRODUCT$spreed"]}