Executive brief
Nextcloud is an open-source platform used by organizations for file sharing and collaboration. A security flaw in the Approval application allows users who do not have permission to share files to bypass these restrictions. By exploiting this, an unauthorized user can force the system to share restricted files with approvers, potentially leading to the exposure of sensitive corporate data.
Technical details
An improper authorization vulnerability (CWE-285) exists in the Nextcloud Approval app prior to version 2.7.2. The flaw allows an authenticated user, even those explicitly restricted from sharing files, to trigger a workflow that forces the system to share files with designated approvers. This is achieved by exploiting the logic within the approval request mechanism. An attacker with low-level network access and valid credentials can gain unauthorized access to restricted files by becoming an 'approver' or forcing distribution to one. The issue is resolved in version 2.7.2; as a workaround, administrators can disable the Approval app.
Affected products
- Nextcloud Approval app < 2.7.2
Timeline
- 2026-03-16: patched: Fix merged in GitHub pull request 392
- 2026-05-12: advisory: GitHub Security Advisory GHSA-v8q8-w6c3-3gv9 published
- 2026-06-01: disclosed: CVE-2026-45275 published to NVD