CVE-2023-28845

Nextcloud talk is a video & audio conferencing app for Nextcloud. In affected versions the talk app does not properly filter access to a conversations member list. As a result an attacker could use this vulnerability to gain information about the members of a Talk conversation, even if they themselves are not members. It is recommended that the Nextcloud Talk is upgraded to 14.0.9 or 15.0.4. There are no known workarounds for this vulnerability.

• CWE-284

• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-3m6r-479j-4chfVendor Advisory
• https://github.com/nextcloud/spreed/pull/8651Patch
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-3m6r-479j-4chfVendor Advisory
• https://github.com/nextcloud/spreed/pull/8651Patch

Published

Mar 31, 2023

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-2884Use of Cryptographically Weak Pseudo-Random Number Generator…9.8
• CVE-2023-28840Moby is an open source container framework developed by Dock…8.7
• CVE-2023-28841Moby is an open source container framework developed by Dock…6.8
• CVE-2023-28842Moby) is an open source container framework developed by Doc…6.8
• CVE-2023-28843PrestaShop/paypal is an open source module for the PrestaSho…9.8
• CVE-2023-28844Nextcloud server is an open source home cloud implementation…6.5
• CVE-2023-28846Unpoly is a JavaScript framework for server-side web applica…7.5
• CVE-2023-28847Nextcloud Server is the file server software for Nextcloud, …7.5
• CVE-2023-28848user_oidc is the OIDC connect user backend for Nextcloud, an…5.4
• CVE-2023-28849GLPI is a free asset and IT management software package. Sta…5.4
• CVE-2023-2885Improper Enforcement of Message Integrity During Transmissio…8.1
• CVE-2023-28850Pimcore Perspective Editor provides an editor for Pimcore th…5.4