The Nextcloud Approval app allows approval or disapproval of files in the sidebar. Prior to 1.3.1 and 2.5.0, an authenticated user listed as a requester in a workflow can set another user’s file into the “pending approval” without access to the file by using the numeric file id. This vulnerability is fixed in 1.3.1 and 2.5.0.
Fix
Patch, vendor advisory and mitigation references on NVD 3
- https://github.com/nextcloud/approval/commit/e30b56b7832255311ac800b7875f44866e88fff4 Patch
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-q26g-fmjq-x5g5 Patch, Vendor Advisory
- https://hackerone.com/reports/3338748 Issue Tracking, Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 2.7 · nextcloudNVD modified 2026-10-15 21:10
Affected (CPE criteria) 1
cpe:2.3:a:nextcloud:approval:*:*:*:*:*:nextcloud:*:*
References 4
- https://github.com/nextcloud/approval/commit/e30b56b7832255311ac800b7875f44866e88fff4 Patch
- https://github.com/nextcloud/approval/pull/334 Issue Tracking
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-q26g-fmjq-x5g5 Patch, Vendor Advisory
- https://hackerone.com/reports/3338748 Issue Tracking, Vendor Advisory