Nextcloud Talk messages can still be seen on conversation after expiring when cron is misconfigured
Priority LOW 21CWE-359Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-359.
Summary
Nextcloud Talk is a fully on-premises audio/video and chat communication service. When cron jobs were misconfigured and therefore messages are not expired, the API would still return them while they were then hidden by the frontend code. It is recommended that the Nextcloud Talk is upgraded to 15.0.3. There are no workaround available.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00799 56th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed security-advisories (nextcloud): 15.0.3
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
- Fix · CNA security-advisories (nextcloud) Fixed in 15.0.3
Timeline
- 2026-10-02 Threatist record created from CVE-2023-26041
References
More Nextcloud Talk vulnerabilities
- TI-2022-20311 Nextcloud Talk guests can continue to receive video streams from call after being removed from a conversation CVSS 3.1MEDIUM 6.5
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences