CVEvulnerability
CVE-2026-45277
3.3 LOW
Official page ↗
- Status
- Analyzed
- Published
- 2026-06-01
- Last modified
- 2026-07-22
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 3.3 LOW — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Weaknesses
- CWE-200
Description
Nextcloud is an open source content collaboration platform. Prior to version 2.7.2, authenticated users can check if arbitrary files are associated with specific approval workflows where they can request approval. This issue has been patched in version 2.7.2.
Affected configurations
• nextcloud approval (< 2.7.2)
Related
Weakness · CWE (1)
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
References
- https://github.com/nextcloud/approval/pull/356 Issue Tracking, Patch
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-h7gm-vgxr-9hcw Mitigation, Vendor Advisory
- https://hackerone.com/reports/3475210 Permissions Required