Threats affecting pkg:github/nextcloud/approval

Nextcloud versions prior to 2.7.2 contain a privilege escalation vulnerability in the Approval app. This flaw allows users without sharing permissions to bypass authorization controls and force the system to share files with approvers. The vulnerability enables unauthorized distribution of restricted files. The issue has been addressed in Nextcloud version 2.7.2. The CVSS score is 6.5, indicating a medium severity level.

The Nextcloud Approval app allows approval or disapproval of files in the sidebar. Prior to 1.3.1 and 2.5.0, an authenticated user listed as a requester in a workflow can set another user’s file into the “pending approval” without access to the file by using the numeric file id. This vulnerability is fixed in 1.3.1 and 2.5.0.