Executive brief
Nextcloud's Approval app is a file review and approval tool used by teams to control which files can be published or modified. A security flaw allows an attacker to approve or reject files without proper validation of file contents, potentially enabling unauthorized publication of stale or malicious file versions and undermining approval workflows.
Technical details
The vulnerability is an authentication/validation bypass in the approve/reject endpoint of Nextcloud's Approval app. The endpoint is designed to enforce an etag (entity tag) freshness check to ensure the approver is acting on the current version of the file and has reviewed recent changes. However, the backend only validates this check when the etag parameter is present and non-empty; if the parameter is omitted entirely, the check is skipped. An attacker with network access to intercept approval requests can remove the etag field, bypass the freshness check, and approve or reject files without confirming the approver reviewed the current version. No authentication bypass is required if the attacker can intercept an existing request. A patch is expected to enforce the freshness check unconditionally.
Affected products
- Nextcloud Approval <UNKNOWN>
Timeline
- 2026-09-18: disclosed
- advisory: CVE-2026-82982