Password of talk conversations can be bruteforced in Nextcloud
Priority MEDIUM 53CWE-307Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-307.
Summary
Nextcloud talk is a chat module for the Nextcloud server platform. In affected versions brute force protection of public talk conversation passwords can be bypassed, as there was an endpoint validating the conversation password without registering bruteforce attempts. It is recommended that the Nextcloud Talk app is upgraded to 15.0.8, 16.0.6 or 17.1.1. There are no known workarounds for this vulnerability.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00598 48th percentileScored 2026-11-07
Fix Fixed security-advisories (nextcloud): 15.0.8, 16.0.6, 17.1.1
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| nextcloud | security-advisories | 15.0.0 to before 15.0.8; 16.0.0 to before 16.0.6; 17.0.0 to before 17.1.1 | 15.0.8, 16.0.6, 17.1.1 | Patch available | CNA |
- security-advisories Vendornextcloud Affected 15.0.0 to before 15.0.8; 16.0.0 to before 16.0.6; 17.0.0 to before 17.1.1 Fixed in 15.0.8, 16.0.6, 17.1.1 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:nextcloud:talk:*:*:*:*:*:*:*:* | 15.0.0 to before 15.0.8; 16.0.0 to before 16.0.6; 17.0.0 to before 17.1.1 | Vulnerable | nextcloud |
- cpe:2.3:a:nextcloud:talk:*:*:*:*:*:*:*:* Versions 15.0.0 to before 15.0.8; 16.0.0 to before 16.0.6; 17.0.0 to before 17.1.1 Vulnerable ·nextcloud
Remediation
- Fix · CNA security-advisories (nextcloud) Fixed in 15.0.8, 16.0.6, 17.1.1
Timeline
- 2026-10-02 Threatist record created from CVE-2023-45149
References
More nextcloud Talk vulnerabilities
- TI-2022-08697 Open Redirect in Nextcloud Talk CVSS 3.1MEDIUM 6.1
- TI-2021-18019 Geolocation preview links can be set to arbitrary links in nextcloud talk CVSS 3.1MEDIUM 6.1
- TI-2022-08700 Exposure of Private Personal Information to an Unauthorized Actor in Nextcloud Talk CVSS 3.1MEDIUM 4.3
- TI-2020-06598 Code injection in Nextcloud Talk CVSS 3.1CRITICAL 9.9
- TI-2023-08722 Passcode bypass on Talk-Android app CVSS 3.1LOW 2.1
- TI-2021-12357 Nextcloud Talk not properly disassociating users from chats after account deletion CVSS 3.1HIGH 8.1
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences