What’s Vulnerable › Vulnerabilities

CVE-2026-45275: Nextcloud: Authorization bypass in approval feature allows unauthorized file sharing with approvers

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-06-01 · updated 2026-07-22
• Weakness: CWE-285

Description

Nextcloud is an open source content collaboration platform. Prior to version 2.7.2, a privilege escalation vulnerability exists in the Approval app that allows a user without sharing permissions to force the system to share a file with approvers. This results in an authorization bypass and privilege escalation, allowing unauthorized distribution of restricted files. This issue has been patched in version 2.7.2.

Affected products

• Nextcloud Approval: before 2.7.2 — fixed in 2.7.2

How to fix

Upgrade to a fixed version: Nextcloud Approval 2.7.2. Check the vendor advisory for mitigations.

References

• https://github.com/nextcloud/approval/pull/392
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-v8q8-w6c3-3gv9
• https://hackerone.com/reports/3593780

Get alerted when CVE-2026-45275 or the next vulnerability affects your stack