Unrated severityNVD Advisory· Published Dec 5, 2025· Updated Dec 5, 2025
Nextcloud Approval app allows users to request approval for other users file
CVE-2025-66515
Description
The Nextcloud Approval app allows approval or disapproval of files in the sidebar. Prior to 1.3.1 and 2.5.0, an authenticated user listed as a requester in a workflow can set another user’s file into the “pending approval” without access to the file by using the numeric file id. This vulnerability is fixed in 1.3.1 and 2.5.0.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2- nextcloud/security-advisoriesv5Range: >= 2.0.0, < 2.5.0
Patches
Vulnerability mechanics
References
4- github.com/nextcloud/approval/commit/e30b56b7832255311ac800b7875f44866e88fff4mitrex_refsource_MISC
- github.com/nextcloud/approval/pull/334mitrex_refsource_MISC
- github.com/nextcloud/security-advisories/security/advisories/GHSA-q26g-fmjq-x5g5mitrex_refsource_CONFIRM
- hackerone.com/reports/3338748mitrex_refsource_MISC
News mentions
0No linked articles in our index yet.