PT-2026-45521 · Nextcloud · Approval App

Yoyomiski · Published 2026-06-01 · Updated 2026-06-02 · CVE-2026-45275

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Nextcloud Approval app versions prior to 2.7.2

Description A privilege escalation issue exists in the Approval app of the Nextcloud content collaboration platform. This flaw allows a user lacking sharing permissions to force the system to share a file with approvers, leading to an authorization bypass and the unauthorized distribution of restricted files.

Recommendations Update to version 2.7.2.

Fix

LPE

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

CVE-2026-45275

Affected Products

Approval App

References · 5

• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-v8q8-w6c3-3gv9 · Vendor Advisory
• https://github.com/nextcloud/approval/pull/392 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-45275 · Security Note
• https://hackerone.com/reports/3593780 · Note
• https://t.me/cveNotify/165644 · Telegram Post