CVE-2026-45275
Prior to version 2.7.2, a privilege escalation vulnerability exists in the Approval app that allows a user without sharing permissions to force the system to share a file with approvers.
Does this matter?
Lower severity and a low EPSS score (0.36%). Track it; it rarely justifies an emergency change on its own.
Description
Nextcloud is an open source content collaboration platform. Prior to version 2.7.2, a privilege escalation vulnerability exists in the Approval app that allows a user without sharing permissions to force the system to share a file with approvers. This results in an authorization bypass and privilege escalation, allowing unauthorized distribution of restricted files. This issue has been patched in version 2.7.2.
- CVSS 3.1
- 6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- EPSS
- 0.36% probability · 29th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-285
- Affected
- nextcloud/approval
- Source
- security-advisories@github.com
References
- https://github.com/nextcloud/approval/pull/392Issue Tracking, Patch
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-v8q8-w6c3-3gv9Mitigation, Vendor Advisory
- https://hackerone.com/reports/3593780Permissions Required
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.