PT-2025-49295 · Nextcloud · Nextcloud Approval App

Published 2025-12-05 · Updated 2025-12-09 · CVE-2025-66515

Positive Technologies (AI Summary)

CVSS v3.1

2.7

Low

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Nextcloud Approval app versions prior to 1.3.1 Nextcloud Approval app versions prior to 2.5.0

Description The Nextcloud Approval app has an issue where an authenticated user, listed as a requester in a workflow, can set another user’s file to “pending approval” without having access to the file. This is achieved by using the numeric file id.

Recommendations Update to Nextcloud Approval app version 1.3.1 or later. Update to Nextcloud Approval app version 2.5.0 or later.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2025-66515

GHSA-Q26G-FMJQ-X5G5

Affected Products

Nextcloud Approval App

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66515.json · Exploit
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-q26g-fmjq-x5g5 · Vendor Advisory
• https://github.com/nextcloud/approval/commit/e30b56b7832255311ac800b7875f44866e88fff4 · Patch
• https://osv.dev/vulnerability/CVE-2025-66515 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-66515 · Security Note
• https://hackerone.com/reports/3338748 · Vendor Advisory
• https://github.com/nextcloud/approval/pull/334 · Note
• https://t.me/CVEtracker/38945 · Telegram Post
• https://t.me/cveNotify/145237 · Telegram Post
• https://twitter.com/CVEnew/status/1997000963480003039 · Twitter Post