VYPR
← All advisories
Low severity2.7NVD Advisory· Published Dec 5, 2025· Updated Jun 17, 2026

CVE-2025-66515

CVE-2025-66515

Description

The Nextcloud Approval app allows approval or disapproval of files in the sidebar. Prior to 1.3.1 and 2.5.0, an authenticated user listed as a requester in a workflow can set another user’s file into the “pending approval” without access to the file by using the numeric file id. This vulnerability is fixed in 1.3.1 and 2.5.0.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

3
  • Nextcloud/Approval2 versions
    cpe:2.3:a:nextcloud:approval:*:*:*:*:*:nextcloud:*:*+ 1 more
    • cpe:2.3:a:nextcloud:approval:*:*:*:*:*:nextcloud:*:*range: >=1.0.0,<1.3.1
    • (no CPE)range: <1.3.1, <2.5.0
  • Nextcloud/security-advisoriescpe-rescue
    Range: >= 2.0.0, < 2.5.0

Patches

Vulnerability mechanics

References

4

News mentions

0

No linked articles in our index yet.