Low severity3.3NVD Advisory· Published Jun 1, 2026· Updated Jun 3, 2026

CVE-2026-45277

Description

Nextcloud is an open source content collaboration platform. Prior to version 2.7.2, authenticated users can check if arbitrary files are associated with specific approval workflows where they can request approval. This issue has been patched in version 2.7.2.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Nextcloud/Approval2 versions
cpe:2.3:a:nextcloud:approval:*:*:*:*:*:nextcloud:*:*+ 1 more
- cpe:2.3:a:nextcloud:approval:*:*:*:*:*:nextcloud:*:*range: <2.7.2
- (no CPE)range: <2.7.2

Patches

Vulnerability mechanics

References

github.com/nextcloud/approval/pull/356nvdIssue TrackingPatch
github.com/nextcloud/security-advisories/security/advisories/GHSA-h7gm-vgxr-9hcwnvdMitigationVendor Advisory
hackerone.com/reports/3475210nvdPermissions Required

News mentions

Nextcloud Server: 25 Vulnerabilities Disclosed in Single Batch
Vypr Intelligence · Jun 1, 2026

cvss	0.214
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000