CVE-2025-66556

Executive Summary

CVE-2025-66556 is a low-severity authorization bypass vulnerability in Nextcloud Talk, the video and audio conferencing application for Nextcloud. The flaw allows a participant with chat permissions to delete poll drafts belonging to other participants within the same conversation by manipulating the numeric ID of the draft. This is a classic Insecure Direct Object Reference (IDOR) vulnerability (CWE-639). The CVSS score is 3.5 (Low), and the EPSS probability is 0.0%, indicating a very low likelihood of exploitation in the wild. The vulnerability is patched in versions 20.1.8 and 21.1.2.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but is a server-side application issue within the Nextcloud ecosystem. Administrators should ensure their Nextcloud Talk app is updated to the patched versions.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
• Base Score: 3.5 (Low)
• Attack Vector: Network (AV:N) – The attacker must be on the same network as the Nextcloud server.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: Low (PR:L) – The attacker needs a valid account with chat permissions in the conversation.
• User Interaction: None (UI:N) – No victim action is required.
• Scope: Unchanged (S:U) – The vulnerability does not affect other components.
• Confidentiality Impact: None (C:N) – No data is exposed.
• Integrity Impact: Low (I:L) – The attacker can delete poll drafts, causing minor data loss.
• Availability Impact: None (A:N) – The service remains available.

Threat Level: Low. The vulnerability requires an authenticated user with chat permissions and only allows deletion of poll drafts, not creation or modification of other sensitive data.

Deep Dive & Mechanics

The vulnerability resides in the poll draft management functionality of Nextcloud Talk. When a user creates a poll draft, the system assigns it a numeric ID. The API endpoint responsible for deleting drafts does not properly verify that the requesting user is the owner of the draft. Instead, it only checks that the user has chat permissions in the conversation.

Attack Flow:

1. An attacker with a valid Nextcloud account and chat permissions in a conversation creates or observes a poll draft.
2. The attacker identifies the numeric ID of another participant's poll draft (e.g., by observing API responses or guessing sequential IDs).
3. The attacker sends a DELETE request to the endpoint /ocs/v2.php/apps/spreed/api/v1/poll/{draftId} with the target draft ID.
4. The server processes the request without verifying ownership, deleting the draft.

Root Cause: Missing authorization check in the deleteDraft function. The code only validates that the user is a participant in the conversation but does not compare the user ID with the owner_id field of the draft.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// In lib/Poll/DraftManager.php
public function deleteDraft(int $draftId, string $token, string $userId): void {
    $draft = $this->draftMapper->findById($draftId);
    if (!$this->roomService->isParticipant($token, $userId)) {
        throw new NoPermissionException();
    }
    $this->draftMapper->delete($draft);
}

Patched Code (Conceptual):

// In lib/Poll/DraftManager.php
public function deleteDraft(int $draftId, string $token, string $userId): void {
    $draft = $this->draftMapper->findById($draftId);
    if (!$this->roomService->isParticipant($token, $userId)) {
        throw new NoPermissionException();
    }
    // Added ownership check
    if ($draft->getOwnerId() !== $userId) {
        throw new NoPermissionException();
    }
    $this->draftMapper->delete($draft);
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• A Nextcloud instance with Talk app version < 20.1.8 or < 21.1.2.
• A valid user account with chat permissions in a conversation.
• Knowledge of another participant's poll draft ID.

Exploitation Steps:

1. Log in to Nextcloud and navigate to a conversation.
2. Create a poll draft (optional, to understand the API).
3. Use browser developer tools to observe the network request when deleting a draft. Note the endpoint: DELETE /ocs/v2.php/apps/spreed/api/v1/poll/{draftId}.
4. Obtain the target draft ID (e.g., by guessing sequential IDs or observing API responses).
5. Send a DELETE request using curl:

   curl -X DELETE \
     'https://nextcloud.example.com/ocs/v2.php/apps/spreed/api/v1/poll/42' \
     -H 'OCS-APIRequest: true' \
     -H 'Authorization: Bearer <your_token>'
   

6. Verify the draft is deleted.

Note: No public exploit code is available for this CVE.

Blue Team

Detection:

• Monitor API logs for DELETE requests to /ocs/v2.php/apps/spreed/api/v1/poll/ from users who are not the owner of the draft.
• Alert on multiple DELETE requests to different poll draft IDs from the same user within a short time frame.

Hunting:

• Query Nextcloud logs for deleteDraft calls and correlate with the owner_id field.
• Use the following Splunk query:

  index=nextcloud sourcetype=nextcloud:talk
  "deleteDraft" | rex "draftId=(?<draftId>\d+)" | rex "userId=(?<userId>\S+)" | rex "ownerId=(?<ownerId>\S+)" | where userId != ownerId
  

Lab Setup:

1. Deploy a vulnerable Nextcloud instance using Docker:

   docker run -d -p 8080:80 --name nextcloud_vuln nextcloud:25.0.0
   

2. Install the Talk app version 20.1.7:

   docker exec -it nextcloud_vuln /bin/bash
   apt-get update && apt-get install -y wget
   wget https://github.com/nextcloud-releases/talk/releases/download/v20.1.7/talk.tar.gz
   tar -xzf talk.tar.gz -C /var/www/html/apps/
   

3. Configure Nextcloud and enable the Talk app.
4. Create two users and a conversation to test the vulnerability.

Indicators of Compromise (IOCs)

• Network:
  • DELETE requests to /ocs/v2.php/apps/spreed/api/v1/poll/ with a numeric ID.
  • HTTP 200 responses to unauthorized DELETE requests.
• Logs:
  • Nextcloud log entries containing deleteDraft with mismatched userId and ownerId.
• System:
  • Unexplained deletion of poll drafts in conversations.

Detection Engineering

YARA Rule

rule Nextcloud_Talk_Poll_Draft_Deletion {
    meta:
        description = "Detects attempts to delete poll drafts in Nextcloud Talk"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-66556"
    strings:
        $s1 = "DELETE /ocs/v2.php/apps/spreed/api/v1/poll/" ascii nocase
        $s2 = "deleteDraft" ascii nocase
    condition:
        any of them
}

Sigma Rule

title: Nextcloud Talk Poll Draft Deletion Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects unauthorized deletion of poll drafts in Nextcloud Talk
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-66556
logsource:
    category: application
    product: nextcloud
    service: talk
detection:
    selection:
        EventID: "deleteDraft"
        UserID|re: ".*"
        OwnerID|re: ".*"
    condition: selection and UserID != OwnerID
falsepositives:
    - Legitimate deletion by the owner
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-66556 Nextcloud Talk Poll Draft Deletion Attempt";
    flow:to_server;
    content:"DELETE";
    http_method;
    content:"/ocs/v2.php/apps/spreed/api/v1/poll/";
    http_uri;
    pcre:"/\/poll\/\d+$/";
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Update Nextcloud Talk to version 20.1.8 or 21.1.2 (or later).
2. If immediate patching is not possible, restrict chat permissions to trusted users only.
3. Monitor logs for suspicious DELETE requests to poll endpoints.

Long-term Measures:

• Implement proper authorization checks for all API endpoints.
• Use UUIDs instead of sequential numeric IDs for poll drafts to prevent ID guessing.
• Conduct regular security audits of custom applications.

Patch Details:

• Fixed Versions: 20.1.8, 21.1.2
• Patch Commit: Not publicly available, but the fix involves adding an ownership check in the deleteDraft function.

Valters IT