Session Fixation in Nextcloud Talk
Priority LOW 31CWE-384Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Spoofing
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-384.
Summary
Nextcloud Talk is a fully on-premises audio/video and chat communication service. Password protected shared chats in Talk before version 9.0.10, 10.0.8 and 11.2.2 did not rotate the session cookie after a successful authentication event. It is recommended that the Nextcloud Talk App is upgraded to 9.0.10, 10.0.8 or 11.2.2. No workarounds for this vulnerability are known to exist.
Why it matters now
EPSS 0.00953 61st percentileScored 2026-11-07
Fix Fixed security-advisories (nextcloud): 9.0.10, 10.0.8, 11.2.2
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| nextcloud | security-advisories | before 9.0.10; 10.0.0 to before 10.0.8; 11.0.0 to before 11.2.2 | 9.0.10, 10.0.8, 11.2.2 | Patch available | CNA |
- security-advisories Vendornextcloud Affected before 9.0.10; 10.0.0 to before 10.0.8; 11.0.0 to before 11.2.2 Fixed in 9.0.10, 10.0.8, 11.2.2 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:nextcloud:talk:*:*:*:*:*:*:*:* | before 9.0.10; 10.0.0 to before 10.0.8; 11.2.0 to before 11.2.2 | Vulnerable | nextcloud |
- cpe:2.3:a:nextcloud:talk:*:*:*:*:*:*:*:* Versions before 9.0.10; 10.0.0 to before 10.0.8; 11.2.0 to before 11.2.2 Vulnerable ·nextcloud
Remediation
- Fix · CNA security-advisories (nextcloud) Fixed in 9.0.10, 10.0.8, 11.2.2
Timeline
- 2026-10-02 Threatist record created from CVE-2021-32676
References
More nextcloud Talk vulnerabilities
- TI-2022-08697 Open Redirect in Nextcloud Talk CVSS 3.1MEDIUM 6.1
- TI-2021-18019 Geolocation preview links can be set to arbitrary links in nextcloud talk CVSS 3.1MEDIUM 6.1
- TI-2023-24170 Password of talk conversations can be bruteforced in Nextcloud CVSS 3.1MEDIUM 4.3
- TI-2022-08700 Exposure of Private Personal Information to an Unauthorized Actor in Nextcloud Talk CVSS 3.1MEDIUM 4.3
- TI-2020-06598 Code injection in Nextcloud Talk CVSS 3.1CRITICAL 9.9
- TI-2023-08722 Passcode bypass on Talk-Android app CVSS 3.1LOW 2.1
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences