The flaw allows a low‑privileged user to force other users’ microphones to be muted while using internal signaling in Nextcloud without a proper permission check. This is an incorrect access control weakness (CWE‑284) that lets an attacker disrupt the audio component of a call, thereby impacting collaboration availability. The vulnerability does not expose data or allow arbitrary code execution; it merely causes a denial of service to selected participants. The attack would not change the overall confidentiality or integrity of the system beyond the audible interruption.

All Nextcloud installations running a version prior to 21.1.10, 22.0.11, or 23.0.3 that do not have a High‑performance Backend installed are affected. The weakness resides in the Spreed call module of Nextcloud.

The CVSS score of 3.5 classifies the issue as low severity, and the EPSS score is unavailable, indicating no obvious evidence of widespread exploitation. The flaw is not listed in CISA’s KEV catalog, and no public exploit has been reported. The attack can be carried out by any user who has access to a call and is authenticated to the server; the attacker would need to send a force‑mute request through the internal signaling channel. Because the damage is limited to audio interruption and requires only low‑privileged credentials, the overall risk is considered low for most deployments.