CVE-2026-45266: Nextcloud Unauthorized Call Microphone Mute Vulnerability

Technical summary

CVE-2026-45266 is an improper access control vulnerability (CWE-284) in Nextcloud's call handling mechanism. A low-privileged, authenticated user can send requests that force other users' microphones to mute state without their consent. The vulnerability exists in call signaling logic and is only exploitable when Nextcloud is deployed without a High-performance Backend (HPB)—a component that normally adds stricter validation and authorization controls around call state changes. The attack requires network access and user interaction from the target (UI:R per CVSS vector), meaning the victim must have an active call session.

Business impact

Disruption of voice communication within Nextcloud Talk can harm remote team collaboration, training sessions, and client meetings. While an attacker cannot eavesdrop or steal data, the ability to silence participants without their knowledge creates a denial-of-service condition for audio communication. For organizations relying on Nextcloud as their primary unified communications platform, this could undermine meeting effectiveness and user trust in the platform's reliability.

Affected systems

Nextcloud versions prior to 21.1.10, 22.0.11, and 23.0.3 are affected. Deployments are vulnerable only if they do not have a High-performance Backend installed and configured. Administrators using HPB are already protected. Community editions and self-hosted instances without HPB represent the primary exposure.

Exploitability

Exploitation requires valid Nextcloud credentials and an active call involving the target user. The attack is straightforward—a malicious user joins a call and sends crafted requests to mute others—making it low-effort once authenticated. However, the requirement for user interaction (the target must be in an active call) and the absence of remote code execution or privilege escalation limits real-world impact. This is not remotely exploitable from the internet without prior account compromise.

Remediation

Upgrade to Nextcloud 21.1.10, 22.0.11, or 23.0.3 or later. Organizations on older major versions should plan upgrades according to their support lifecycle. Alternatively, implement a High-performance Backend, which mitigates the vulnerability through stricter authorization enforcement on call state changes. Verify patch deployment in your Nextcloud administration console.

Patch guidance

Administrators should prioritize patching in the next routine maintenance window. Download the patched versions directly from the official Nextcloud release channels. For containerized deployments, update your Nextcloud image to the patched version and redeploy. For source installations, pull the latest code from the official repository. After patching, restart Nextcloud services and verify call functionality in a test call before resuming production use.

Detection guidance

Monitor Nextcloud logs for repeated call-state modification requests from low-privileged accounts, particularly those that result in mute events for other users. Look for unusual patterns in talk_commands or signaling logs around audio control. If you lack High-performance Backend, review call logs during suspected incident windows to correlate mute events with unauthorized user actions. Network-level detection is difficult without call protocol inspection; log-based detection is more practical.

Why prioritize this

Although CVSS 3.5 (LOW) reflects minimal confidentiality and availability impact, this vulnerability directly impairs a core communication feature. Prioritize patching if your organization relies on Nextcloud Talk for day-to-day collaboration or if you have low-privileged user populations with call access. If you deploy High-performance Backend, this is lower priority. For smaller teams or internal deployments, routine patching within 30 days is appropriate.

Risk score, explained

The CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N score of 3.5 (LOW) reflects: Network-accessible attack surface, low attack complexity, low-privilege attacker requirement, but user interaction needed (call must be active). No confidentiality loss, minor integrity impact (audio control), no availability loss at system level. The score appropriately reflects that this is a nuisance attack with limited scope rather than a critical vulnerability.

Frequently asked questions