CVE-2023-30540

    Dashboard / Vulnerabilities / CVE-2023-30540

    CVE-2023-30540

    Published: 17 Apr 2023Last Modified: 12 Aug 2026

    Summary: Chat poll data can still be queried from API after purging history in Nextcloud talk

    Details: Nextcloud Talk is a chat, video & audio call extension for Nextcloud. In affected versions a user that was added later to a conversation can use this information to get access to data that was deleted before they were added to the conversation. This issue has been patched in version 15.0.5 and it is recommended that users upgrad to 15.0.5. There are no known workarounds for this issue.

    References: https://hackerone.com/reports/1894676, https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/30xxx/CVE-2023-30540.json, https://github.com/nextcloud/security-advisories/security/advisories/GHSA-c9hr-cq65-9mjw, https://nvd.nist.gov/vuln/detail/CVE-2023-30540, https://github.com/nextcloud/spreed/pull/8985

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 7149ff90e030daff312bf973d5c9b219e0fa6061
    Fixed -4cc2540bc1eb6e8679c82678f05e0149faa50e35

    Affected versions

    v15.0.4
    v15.0.3
    v15.0.2
    v15.0.1
    v15.0.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2023-30540 | CVE-DB