# CVE-2025-66515: The Nextcloud Approval app allows approval or disapproval of files in the sidebar. Prior to 1.3.1 and 2.5.0, an…

Source: https://junglewise.ai/threats/cve-2025-66515-the-nextcloud-approval-app-allows-approval-or-disapproval-of  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-12-05  
License: CC BY 4.0 with a link back

CVE-2025-66515 · Severity: low · CVSS 2.7 · Published 2025-12-05

The Nextcloud Approval app allows approval or disapproval of files in the sidebar. Prior to 1.3.1 and 2.5.0, an authenticated user listed as a requester in a workflow can set another user’s file into the “pending approval” without access to the file by using the numeric file id. This vulnerability is fixed in 1.3.1 and 2.5.0.

Technologies: [Nextcloud Approval](https://junglewise.ai/threats/technologies/approval). Vendors: [Nextcloud](https://junglewise.ai/threats/vendors/nextcloud).

## Quick answers

**Is CVE-2025-66515 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-66515 being exploited in the wild.

**How severe is CVE-2025-66515?** Low severity, with a CVSS score of 2.7, published 5 December 2025.

**Which products and versions are affected?** Nextcloud Approval. The advisory does not name versions.

**Is there a fix for CVE-2025-66515?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**Am I affected by CVE-2025-66515?** Check whether you run Nextcloud Approval. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- Nextcloud Approval

## Related threats

- [Nextcloud Approval app freshness check bypass in approve/reject endpoint](https://junglewise.ai/threats/cve-2026-82982-nextcloud-approval-app-freshness-check-bypass-in-approve-reject)
- [Nextcloud Approval app information disclosure via fileId parameter](https://junglewise.ai/threats/cve-2026-45277-nextcloud-approval-app-information-disclosure-via-fileid)
- [Nextcloud Approval app privilege escalation in file sharing](https://junglewise.ai/threats/cve-2026-45275-nextcloud-approval-app-privilege-escalation-in-file-sharing)