CVE-2025-66515

Published: Dec 5, 2025Modified: Jun 17, 2026

2.7

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

Exploitability: 1.2 / Impact: 1.4

Source: security-advisories@github.com (Secondary)

Description

The Nextcloud Approval app allows approval or disapproval of files in the sidebar. Prior to 1.3.1 and 2.5.0, an authenticated user listed as a requester in a workflow can set another user’s file into the “pending approval” without access to the file by using the numeric file id. This vulnerability is fixed in 1.3.1 and 2.5.0.

Affected (2)

Products: Nextcloud: Approval

1 product

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Nextcloud Approval	From 1.0.0 to 1.3.1
Nextcloud Approval	From 2.0.0 to 2.5.0

Related CWEs

Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

References (4)

https://github.com/nextcloud/approval/commit/e30b56b7832255311ac800b7875f44866e88fff4

Source: security-advisories@github.com

Patch

https://github.com/nextcloud/approval/pull/334

Source: security-advisories@github.com

Issue Tracking

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-q26g-fmjq-x5g5

Source: security-advisories@github.com

PatchVendor Advisory

https://hackerone.com/reports/3338748

Source: security-advisories@github.com

Issue TrackingVendor Advisory

Timeline

No history available yet.