CVE-2022-24890

Nextcloud Talk is a video and audio conferencing app for Nextcloud. In versions prior to 13.0.5 and 14.0.0, a call moderator can indirectly enable user webcams by granting permissions, if they were enabled before removing the permissions. A patch is available in versions 13.0.5 and 14.0.0. There are currently no known workarounds.

• CWE-200
• CWE-359
• CWE-276

• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-vxpr-hcqq-7fw7Third Party Advisory
• https://github.com/nextcloud/spreed/issues/7048Exploit, Issue Tracking, Third Party Advisory
• https://github.com/nextcloud/spreed/pull/7034Exploit, Third Party Advisory
• https://github.com/nextcloud/spreed/pull/7092Patch, Third Party Advisory
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-vxpr-hcqq-7fw7Third Party Advisory
• https://github.com/nextcloud/spreed/issues/7048Exploit, Issue Tracking, Third Party Advisory
• https://github.com/nextcloud/spreed/pull/7034Exploit, Third Party Advisory
• https://github.com/nextcloud/spreed/pull/7092Patch, Third Party Advisory

Published

May 17, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-24885Nextcloud Android app is the Android client for Nextcloud, a…2.4
• CVE-2022-24886Nextcloud Android app is the Android client for Nextcloud, a…3.8
• CVE-2022-24887Nextcloud Talk is a video and audio conferencing app for Nex…6.1
• CVE-2022-24888Nextcloud Server is the file server software for Nextcloud, …4.3
• CVE-2022-24889Nextcloud Server is the file server software for Nextcloud, …4.3
• CVE-2022-2489A vulnerability was found in SourceCodester Simple E-Learnin…8.8
• CVE-2022-24891ESAPI (The OWASP Enterprise Security API) is a free, open so…6.1
• CVE-2022-24892Shopware is an open source e-commerce software platform. Sta…7.5
• CVE-2022-24893ESP-IDF is the official development framework for Espressif …8.8
• CVE-2022-24894Symfony is a PHP framework for web and console applications …8.8
• CVE-2022-24895Symfony is a PHP framework for web and console applications …8.8
• CVE-2022-24896Tuleap is a Free & Open Source Suite to manage software deve…4.3