CVE-2026-45275

Description

Nextcloud is an open source content collaboration platform. Prior to version 2.7.2, a privilege escalation vulnerability exists in the Approval app that allows a user without sharing permissions to force the system to share a file with approvers. This results in an authorization bypass and privilege escalation, allowing unauthorized distribution of restricted files. This issue has been patched in version 2.7.2.

PUBLISHED Reserved 2026-05-11 | Published 2026-06-01 | Updated 2026-06-01 | Assigner GitHub_M

Problem types

CWE-285: Improper Authorization

Product status

References

github.com/...sories/security/advisories/GHSA-v8q8-w6c3-3gv9

github.com/nextcloud/approval/pull/392

hackerone.com/reports/3593780

cve.org (CVE-2026-45275)

nvd.nist.gov (CVE-2026-45275)

Download JSON