CVE-2026-45277

Published: Jun 1, 2026Modified: Jul 22, 2026

3.3

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Exploitability: 1.8 / Impact: 1.4

Source: security-advisories@github.com (Secondary)

Description

Nextcloud is an open source content collaboration platform. Prior to version 2.7.2, authenticated users can check if arbitrary files are associated with specific approval workflows where they can request approval. This issue has been patched in version 2.7.2.

Affected (1)

Products: Nextcloud: Approval

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Nextcloud Approval	Before 2.7.2

Related CWEs

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (3)

https://github.com/nextcloud/approval/pull/356

Source: security-advisories@github.com

Issue TrackingPatch

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-h7gm-vgxr-9hcw

Source: security-advisories@github.com

MitigationVendor Advisory

https://hackerone.com/reports/3475210

Source: security-advisories@github.com

Permissions Required

Timeline

No history available yet.