CVE-2026-45275

Description

Nextcloud is an open source content collaboration platform. Prior to version 2.7.2, a privilege escalation vulnerability exists in the Approval app that allows a user without sharing permissions to force the system to share a file with approvers. This results in an authorization bypass and privilege escalation, allowing unauthorized distribution of restricted files. This issue has been patched in version 2.7.2.

Traduire en français

Produits concernés

• nextcloud security-advisories
• Nextcloud approval

Scores CVSS

Faiblesses (CWE)

• CWE-285

Références

• https://github.com/nextcloud/approval/pull/392 Issue TrackingPatch
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-v8q8-w6c3-3gv9 MitigationVendor Advisory
• https://hackerone.com/reports/3593780 Permissions Required

Ailleurs

• NVD
• CVE.org
• CIRCL Vulnerability-Lookup
• CERT-FR
• GitHub Advisories