CVEvulnerability
CVE-2025-66515
2.7 LOW
Official page ↗
- Status
- Analyzed
- Published
- 2025-12-05
- Last modified
- 2026-10-15
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 2.7 LOW — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
- Weaknesses
- CWE-287
Description
The Nextcloud Approval app allows approval or disapproval of files in the sidebar. Prior to 1.3.1 and 2.5.0, an authenticated user listed as a requester in a workflow can set another user’s file into the “pending approval” without access to the file by using the numeric file id. This vulnerability is fixed in 1.3.1 and 2.5.0.
Affected configurations
• nextcloud approval (>= 1.0.0 < 1.3.1)
• nextcloud approval (>= 2.0.0 < 2.5.0)
Related
Weakness · CWE (1)
- CWE-287 Improper Authentication weakness
References
- https://github.com/nextcloud/approval/commit/e30b56b7832255311ac800b7875f44866e88fff4 Patch
- https://github.com/nextcloud/approval/pull/334 Issue Tracking
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-q26g-fmjq-x5g5 Patch, Vendor Advisory
- https://hackerone.com/reports/3338748 Issue Tracking, Vendor Advisory