Moderator can enable cam/mic remotely if cam/mic-permission was disabled while user has activated cam/mic

Description

Impact

A call moderator can indirectly enable user webcams by granting permissions, if they were enabled before removing the permissions.

Patches

It is recommended that the Nextcloud Talk app is upgraded to 13.0.5 .

Workarounds

No workaround available

References

nextcloud/spreed#7034
<https://hackerone.com/reports/1520685&gt;

For more information

If you have any questions or comments about this advisory:

• Create a post in nextcloud/security-advisories
• Customers: Open a support ticket at support.nextcloud.com