Nextcloud <21.1.10/22.0.11/23.0.3: low-priv user muting mic in calls
CVE-2026-45266 Published on June 1, 2026
Nextcloud: Unauthorized force-mute from missing permission check when using internal signaling
Nextcloud is an open source content collaboration platform. Prior to versions 21.1.10, 22.0.11, and 23.0.3, a low-privileged user can force other user's microphones to be muted in calls when no High-performance Backend is installed. This issue has been patched in versions 21.1.10, 22.0.11, and 23.0.3.
Vulnerability Analysis
CVE-2026-45266 is exploitable with network access, requires user interaction and a small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality, with no impact on integrity, and no impact on availability.
Weakness Type
What is an Authorization Vulnerability?
The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CVE-2026-45266 has been classified to as an Authorization vulnerability or weakness.
Affected Versions
nextcloud security-advisories:- Version < 21.1.10 is affected.
- Version < 22.0.11 is affected.
- Version < 23.0.3 is affected.