Open Redirect in Nextcloud Talk
Priority MEDIUM 60CWE-601Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Spoofing
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-601.
Summary
Nextcloud Talk is a video and audio conferencing app for Nextcloud, a self-hosted productivity platform. Prior to versions 11.3.4, 12.2.2, and 13.0.0, when sharing a Deck card in conversation, the metaData can be manipulated so users can be tricked into opening arbitrary URLs. This issue is fixed in versions 11.3.4, 12.2.2, and 13.0.0. There are currently no known workarounds.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00938 61st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed security-advisories (nextcloud): 11.3.4, 12.2.2, 13.0.0
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| nextcloud | security-advisories | before 11.3.4; before 12.2.2; before 13.0.0 | 11.3.4, 12.2.2, 13.0.0 | Patch available | CNA |
- security-advisories Vendornextcloud Affected before 11.3.4; before 12.2.2; before 13.0.0 Fixed in 11.3.4, 12.2.2, 13.0.0 Patch available CNA
CPE configurations NVD · 5
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:nextcloud:talk:*:*:*:*:*:*:*:* | before 11.3.4; 12.0.0 to before 12.2.4 | Vulnerable | nextcloud |
| cpe:2.3:a:nextcloud:talk:13.0.0:rc1:*:*:*:*:*:* | 13.0.0 rc1 | Vulnerable | nextcloud |
| cpe:2.3:a:nextcloud:talk:13.0.0:rc2:*:*:*:*:*:* | 13.0.0 rc2 | Vulnerable | nextcloud |
| cpe:2.3:a:nextcloud:talk:13.0.0:rc3:*:*:*:*:*:* | 13.0.0 rc3 | Vulnerable | nextcloud |
| cpe:2.3:a:nextcloud:talk:13.0.0:rc4:*:*:*:*:*:* | 13.0.0 rc4 | Vulnerable | nextcloud |
- cpe:2.3:a:nextcloud:talk:*:*:*:*:*:*:*:* Versions before 11.3.4; 12.0.0 to before 12.2.4 Vulnerable ·nextcloud
- cpe:2.3:a:nextcloud:talk:13.0.0:rc1:*:*:*:*:*:* Versions 13.0.0 rc1 Vulnerable ·nextcloud
- cpe:2.3:a:nextcloud:talk:13.0.0:rc2:*:*:*:*:*:* Versions 13.0.0 rc2 Vulnerable ·nextcloud
- cpe:2.3:a:nextcloud:talk:13.0.0:rc3:*:*:*:*:*:* Versions 13.0.0 rc3 Vulnerable ·nextcloud
- cpe:2.3:a:nextcloud:talk:13.0.0:rc4:*:*:*:*:*:* Versions 13.0.0 rc4 Vulnerable ·nextcloud
Remediation
- Fix · CNA security-advisories (nextcloud) Fixed in 11.3.4, 12.2.2, 13.0.0
Timeline
- 2026-10-02 Threatist record created from CVE-2022-24887
References
More nextcloud Talk vulnerabilities
- TI-2021-18019 Geolocation preview links can be set to arbitrary links in nextcloud talk CVSS 3.1MEDIUM 6.1
- TI-2023-24170 Password of talk conversations can be bruteforced in Nextcloud CVSS 3.1MEDIUM 4.3
- TI-2022-08700 Exposure of Private Personal Information to an Unauthorized Actor in Nextcloud Talk CVSS 3.1MEDIUM 4.3
- TI-2020-06598 Code injection in Nextcloud Talk CVSS 3.1CRITICAL 9.9
- TI-2023-08722 Passcode bypass on Talk-Android app CVSS 3.1LOW 2.1
- TI-2021-12357 Nextcloud Talk not properly disassociating users from chats after account deletion CVSS 3.1HIGH 8.1
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences