Low · published December 5, 2025
The Nextcloud Approval app allows approval or disapproval of files in the sidebar. Prior to 1.3.1 and 2.5.0, an authenticated user listed as a requester in a workflow can set another user’s file into the “pending approval” without access to the file by using the numeric file id. This vulnerability is fixed in 1.3.1 and 2.5.0.
| Product | Versions | Fixed in |
|---|---|---|
| nextcloud/approval | ≥ 1.0.0, < 1.3.1 | 1.3.1 |
| nextcloud/approval | ≥ 2.0.0, < 2.5.0 | 2.5.0 |