CVE-2025-66515

The Nextcloud Approval app allows approval or disapproval of files in the sidebar. Prior to 1.3.1 and 2.5.0, an authenticated user listed as a requester in a workflow can set another user’s file into the “pending approval” without access to the file by using the numeric file id. This vulnerability is fixed in 1.3.1 and 2.5.0.

CVSS 3.1

2.7CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

EPSS

0.3% chance of exploitation in the next 30 days; higher than 23% of CVEs (scores of 2026-10-25)

CWE

CWE-287

Published

2025-12-05

Modified

2026-10-15

Record from

the NVD, synced 2026-10-19

Affected

• nextcloud:approval

References

• https://github.com/nextcloud/approval/commit/e30b56b7832255311ac800b7875f44866e88fff4
• https://github.com/nextcloud/approval/pull/334
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-q26g-fmjq-x5g5
• https://hackerone.com/reports/3338748

Check your stackJSON