CVE-2026-45275: Nextcloud Approval

Medium severity, CVSS 6.5. EPSS: 0.5% chance of exploitation in the next 30 days.

Nextcloud is an open source content collaboration platform. Prior to version 2.7.2, a privilege escalation vulnerability exists in the Approval app that allows a user without sharing permissions to force the system to share a file with approvers. This results in an authorization bypass and privilege escalation, allowing unauthorized distribution of restricted files. This issue has been patched in version 2.7.2.

Affected products

• Nextcloud Approval: before 2.7.2 (fixed in 2.7.2)

Published 2026-06-01. Last modified 2026-07-22.