CVE-2021-32689

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2021-32689
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-32689.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2021-32689
Related
  • GHSA-xv6f-344w-895c
Published
2021-07-12T19:15:10.127Z
Modified
2026-04-10T04:33:50.776654Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
[none]
Details

Nextcloud Talk is a fully on-premises audio/video and chat communication service. In versions prior to 11.2.2, if a user was able to reuse an earlier used username, they could get access to any chat message sent to the previous user with this username. The issue was patched in versions 11.2.2 and 11.3.0. As a workaround, don't allow users to choose usernames themselves. This is the default behaviour of Nextcloud, but some user providers may allow doing so.

References

Affected packages

Git / github.com/nextcloud/spreed

Affected ranges

Type
GIT
Repo
https://github.com/nextcloud/spreed
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
1d3c90d7121cd06c6a4c7bd23729eac9fbf595f5
Fixed
bb5f07315e95e18cf770f9390c812ddecf1f7cc9
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "11.2.2"
        }
    ]
}

Affected versions

v1.*
v1.0.21
v1.0.22
v1.1.2
v1.2
v10.*
v10.0.0-beta.1
v10.0.0-beta.2
v10.0.0-rc.1
v11.*
v11.0.0
v11.0.0-alpha.1
v11.0.0-alpha.2
v11.0.0-alpha.3
v11.0.0-alpha.4
v11.0.0-rc.1
v11.1.0
v11.1.1
v11.1.2
v11.2.0
v11.2.1
v2.*
v2.0.0
v2.9.0
v2.9.1
v3.*
v3.0.0
v3.0.1
v3.99.10
v3.99.11
v3.99.12
v3.99.8
v4.*
v4.0.0
v4.99.5
v5.*
v5.99.10
v6.*
v6.0.0-rc.1
v6.0.0-rc.2
v7.*
v7.0.0-beta.1
v8.*
v8.0.0
v8.0.0-alpha.1
v8.0.0-alpha.2
v8.0.0-alpha.3
v8.0.0-alpha.4
v8.0.0-alpha.5
v8.0.0-alpha.6
v9.*
v9.0.0-beta.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-32689.json"