Detections
Analytics
CVE-2025-66515
low
Description
The Nextcloud Approval app allows approval or disapproval of files in the sidebar. Prior to 1.3.1 and 2.5.0, an authenticated user listed as a requester in a workflow can set another user’s file into the “pending approval” without access to the file by using the numeric file id. This vulnerability is fixed in 1.3.1 and 2.5.0.
References
https://hackerone.com/reports/3338748
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-q26g-fmjq-x5g5
https://github.com/nextcloud/approval/pull/334
https://github.com/nextcloud/approval/commit/e30b56b7832255311ac800b7875f44866e88fff4