CVE-2025-66515

The Nextcloud Approval app allows approval or disapproval of files in the sidebar. Prior to 1.3.1 and 2.5.0, an authenticated user listed as a requester in a workflow can set another user’s file into the “pending approval” without access to the file by using the numeric file id. This vulnerability is fixed in 1.3.1 and 2.5.0.

CVSS v3 2.7 LOW

2.7^/10

CVSS v3 : LOW

Vector :

Exploitability : 1.2 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/nextcloud/approval/commit/e30b56b7832255311ac800b7875f44866e88fff4	Patch
https://github.com/nextcloud/approval/pull/334	Issue Tracking
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-q26g-fmjq-x5g5	Patch Vendor Advisory
https://hackerone.com/reports/3338748	Issue Tracking Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:nextcloud:approval::::::nextcloud::*
	cpe:2.3:a:nextcloud:approval::::::nextcloud::*

History

15 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) La aplicación?Approval?de?Nextcloud permite aprobar o desaprobar archivos en la barra lateral. Versiones anteriores a?1.3.1?y?2.5.0, un usuario autenticado listado como solicitante en un workflow puede colocar el archivo de otro usuario en “pendiente de aprobación” sin tener acceso al archivo mediante el identificador numérico del archivo. Esta vulnerabilidad está corregida en?1.3.1?y?2.5.0.

Information

Published : 2025-12-05 18:15

Updated : 2026-10-15 21:10

NVD link : CVE-2025-66515

Mitre link : CVE-2025-66515

CVE.ORG link : CVE-2025-66515

JSON object : View

Products Affected

nextcloud

approval

CWE

CWE-287

Improper Authentication

{"id": "CVE-2025-66515", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-66515", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-05T18:03:48.806874Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 2.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 1.2}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "nextcloud", "product": "security-advisories", "versions": [{"status": "affected", "version": ">= 2.0.0, < 2.5.0"}, {"status": "affected", "version": "< 1.3.1"}]}]}], "published": "2025-12-05T18:15:57.623", "references": [{"url": "https://github.com/nextcloud/approval/commit/e30b56b7832255311ac800b7875f44866e88fff4", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/nextcloud/approval/pull/334", "tags": ["Issue Tracking"], "source": "security-advisories@github.com"}, {"url": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-q26g-fmjq-x5g5", "tags": ["Patch", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://hackerone.com/reports/3338748", "tags": ["Issue Tracking", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-287"}]}], "descriptions": [{"lang": "en", "value": "The Nextcloud Approval app allows approval or disapproval of files in the sidebar. Prior to 1.3.1 and 2.5.0, an authenticated user listed as a requester in a workflow can set another user\u2019s file into the \u201cpending approval\u201d without access to the file by using the numeric file id. This vulnerability is fixed in 1.3.1 and 2.5.0."}, {"lang": "es", "value": "La aplicaci\u00f3n?Approval?de?Nextcloud permite aprobar o desaprobar archivos en la barra lateral. Versiones anteriores a?1.3.1?y?2.5.0, un usuario autenticado listado como solicitante en un workflow puede colocar el archivo de otro usuario en \u201cpendiente de aprobaci\u00f3n\u201d sin tener acceso al archivo mediante el identificador num\u00e9rico del archivo. Esta vulnerabilidad est\u00e1 corregida en?1.3.1?y?2.5.0."}], "lastModified": "2026-10-15T21:10:00.327", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:nextcloud:approval:*:*:*:*:*:nextcloud:*:*", "vulnerable": true, "matchCriteriaId": "37339E72-6EB5-4D2D-82E4-EB81C9FC8E39", "versionEndExcluding": "1.3.1", "versionStartIncluding": "1.0.0"}, {"criteria": "cpe:2.3:a:nextcloud:approval:*:*:*:*:*:nextcloud:*:*", "vulnerable": true, "matchCriteriaId": "558060E7-4BE3-4E6F-93FD-4CF3584CDE96", "versionEndExcluding": "2.5.0", "versionStartIncluding": "2.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}