3.3

CVE-2026-45277

Nextcloud: Information disclosure in Nextcloud Approval app via fileId parameter reveals workflow associations

fileId parameter reveals workflow associations in Nextcloud Approval app

Nextcloud is an open source content collaboration platform. Prior to version 2.7.2, authenticated users can check if arbitrary files are associated with specific approval workflows where they can request approval. This issue has been patched in version 2.7.2.
Mögliche Gegenmaßnahme
Approval: * Disable the Approval app * No other workaround available
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Nextcloud ≫ Approval SwPlatformnextcloud Version < 2.7.2
Weitere Schwachstelleninformationen
SystemNextcloud App
≫
Produkt Approval
Version < 2.7.2
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.13% 0.029
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
security-advisories@github.com 3.3 1.8 1.4
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-h7gm-vgxr-9hcw
Vendor Advisory
Mitigation
https://github.com/nextcloud/approval/pull/356
Patch
Issue Tracking
https://hackerone.com/reports/3475210
Permissions Required
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-h7gm-vgxr-9hcw
Third Party Advisory