CVE-2026-45277

3.3 lowEPSS 0.1%

Low (3.3) in nextcloud approval. EPSS 0.1% chance of exploitation in the next 30 days.

Nextcloud is an open source content collaboration platform. Prior to version 2.7.2, authenticated users can check if arbitrary files are associated with specific approval workflows where they can request approval. This issue has been patched in version 2.7.2.

Severity

CVSS 3.1

3.3 low

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

EPSS: 0.1% chance of exploitation in the next 30 days; higher than 2% of CVEs (scores of 2026-10-31)
CWE: CWE-200
Published: 2026-06-01
Modified: 2026-07-22
Record from: the NVD, synced 2026-10-19

Affected

nextcloud:approval

References

https://github.com/nextcloud/approval/pull/356
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-h7gm-vgxr-9hcw
https://hackerone.com/reports/3475210

Check your stack JSON