Nextcloud Approval vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting Nextcloud Approval: 3 record(s), with affected versions and fixes.cpe:2.3:a:nextcloud:approval
CVE-2026-45277
Low · 3.3
CWE-200 Jun 1, 2026
Nextcloud: Information disclosure in Nextcloud Approval app via fileId parameter reveals workflow associations
Nextcloud is an open source content collaboration platform. Prior to version 2.7.2, authenticated users can check if arbitrary files are associated with specific approval workflows where they can request approval. This issue has been patched in version 2.7.2.
CVE-2026-45275
Medium · 6.5
CWE-285 Jun 1, 2026
Nextcloud: Authorization bypass in approval feature allows unauthorized file sharing with approvers
Nextcloud is an open source content collaboration platform. Prior to version 2.7.2, a privilege escalation vulnerability exists in the Approval app that allows a user without sharing permissions to force the system to share a file with approvers. This results in an authorization bypass and privilege escalation, allowing unauthorized distribution of restricted files. This issue has been patched in version 2.7.2.
CVE-2025-66515
Low · 2.7
CWE-287 Dec 5, 2025
Nextcloud Approval app allows users to request approval for other users file
The Nextcloud Approval app allows approval or disapproval of files in the sidebar. Prior to 1.3.1 and 2.5.0, an authenticated user listed as a requester in a workflow can set another user’s file into the “pending approval” without access to the file by using the numeric file id. This vulnerability is fixed in 1.3.1 and 2.5.0.