How severe is CVE-2022-24890?

CVE-2022-24890 has a CVSS 3.x base score of 2.4, rated low severity. It is exploitable over network with low attack complexity, requires high privileges and user interaction. Impact on confidentiality is low, integrity none, and availability none.

Is CVE-2022-24890 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (55th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2022-24890?

CVE-2022-24890 primarily affects Nextcloud Talk. In total, 6 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2022-24890?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2022-24890 published?

CVE-2022-24890 was published on 2022-05-17 and last updated on 2026-06-17.

CVE-2022-24890

CVE-2022-24890 is a low-severity vulnerability in Nextcloud Talk with a CVSS 3.x base score of 2.4. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-276.

Key facts

Severity: Low (CVSS 3.x base score 2.4)
CVSS v2: 3.5
EPSS exploit prediction: 1% (55th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-276
Affected product: Nextcloud Talk
Published: 2022-05-17
Last modified: 2026-06-17

Description

Nextcloud Talk is a video and audio conferencing app for Nextcloud. In versions prior to 13.0.5 and 14.0.0, a call moderator can indirectly enable user webcams by granting permissions, if they were enabled before removing the permissions. A patch is available in versions 13.0.5 and 14.0.0. There are currently no known workarounds.

Frequently asked questions

What is CVE-2022-24890?: Nextcloud Talk is a video and audio conferencing app for Nextcloud. In versions prior to 13.0.5 and 14.0.0, a call moderator can indirectly enable user webcams by granting permissions, if they were enabled before removing the permissions. A patch is available in versions 13.0.5 and 14.0.0. There are currently no known workarounds.
How severe is CVE-2022-24890?: CVE-2022-24890 has a CVSS 3.x base score of 2.4, rated low severity. It is exploitable over network with low attack complexity, requires high privileges and user interaction. Impact on confidentiality is low, integrity none, and availability none.
Is CVE-2022-24890 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (55th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2022-24890?: CVE-2022-24890 primarily affects Nextcloud Talk. In total, 6 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2022-24890?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2022-24890 published?: CVE-2022-24890 was published on 2022-05-17 and last updated on 2026-06-17.

References

Affected products (6)

cpe:2.3:a:nextcloud:talk:*:*:*:*:*:*:*:*
cpe:2.3:a:nextcloud:talk:14.0.0:beta1:*:*:*:*:*:*
cpe:2.3:a:nextcloud:talk:14.0.0:rc1:*:*:*:*:*:*
cpe:2.3:a:nextcloud:talk:14.0.0:rc2:*:*:*:*:*:*
cpe:2.3:a:nextcloud:talk:14.0.0:rc3:*:*:*:*:*:*
cpe:2.3:a:nextcloud:talk:14.0.0:rc4:*:*:*:*:*:*

More vulnerabilities in Nextcloud Talk

CVE-2020-8180 — Critical (CVSS 9.9): A too lax check in Nextcloud Talk 6.0.4, 7.0.2 and 8.0.7 allowed a code injection when a not correctly sanitized talk…
CVE-2021-32689 — High (CVSS 8.1): Nextcloud Talk is a fully on-premises audio/video and chat communication service. In versions prior to 11.2.2, if a…
CVE-2023-39957 — High (CVSS 7.8): Nextcloud Talk Android allows users to place video and audio calls through Nextcloud on Android. Prior to version…
CVE-2021-32676 — Medium (CVSS 6.5): Nextcloud Talk is a fully on-premises audio/video and chat communication service. Password protected shared chats in…
CVE-2021-39222 — Medium (CVSS 6.4): Nextcloud is an open-source, self-hosted productivity platform. The Nextcloud Talk application was vulnerable to a…
CVE-2018-3781 — Medium (CVSS 5.4): A missing sanitization of search results for an autocomplete field in NextCloud Talk <3.2.5 could lead to a stored XSS…

All CVEs affecting Nextcloud Talk →

Other CWE-276 (Incorrect Default Permissions) vulnerabilities

CVE-2022-42150 — Critical (CVSS 10.0): TinyLab linux-lab v1.1-rc1 and cloud-labv0.8-rc2, v1.1-rc1 are vulnerable to insecure permissions. The default…
CVE-2020-29492 — Critical (CVSS 10.0): Dell Wyse ThinOS 8.6 and prior versions contain an insecure default configuration vulnerability. A remote…
CVE-2020-29491 — Critical (CVSS 10.0): Dell Wyse ThinOS 8.6 and prior versions contain an insecure default configuration vulnerability. A remote…
CVE-2025-40585 — Critical (CVSS 9.9): A vulnerability has been identified in Energy Services (All versions with G5DFR). Affected solutions using G5DFR…
CVE-2019-19896 — Critical (CVSS 9.9): In IXP EasyInstall 6.2.13723, there is Remote Code Execution via weak permissions on the Engine Service share. The…
CVE-2020-37129 — Critical (CVSS 9.8): Memu Play 7.1.3 contains an insecure folder permissions vulnerability that allows low-privileged users to modify the…

Browse all CWE-276 (Incorrect Default Permissions) vulnerabilities →