Description
The Nextcloud Approval app allows approval or disapproval of files in the sidebar. Prior to 1.3.1 and 2.5.0, an authenticated user listed as a requester in a workflow can set another user’s file into the “pending approval” without access to the file by using the numeric file id. This vulnerability is fixed in 1.3.1 and 2.5.0.
Affected products
nextcloud: approval
References4
- github.com/nextcloud/security-advisories/security/advisories/GH… PatchVendor Advisory
- hackerone.com/reports/3338748 Issue TrackingVendor Advisory
- github.com/nextcloud/approval/commit/e30b56b7832255311ac800b787… Patch
- github.com/nextcloud/approval/pull/334 Issue Tracking
Metrics
- CVSS 3.1
-
2.7
LOW
Score source: CNA
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N - EPSS — exploit probability
- 0% percentile: 27 · as of 11 November 2026
- CWE
- CWE-287
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.