Nextcloud Approval vulnerabilities

4 CVEs affecting Nextcloud Approval, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-82982, published 2026-09-18.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-45275, published 2026-06-01. Medium severity, CVSS 6.5. EPSS: 0.5% chance of exploitation in the next 30 days. Nextcloud is an open source content collaboration platform. Prior to version 2.7.2, a privilege escalation vulnerability exists in the Approval app that allows a user without sharing permissions to…
CVE-2026-82982, published 2026-09-18. Medium severity, CVSS 4.3. EPSS: 0.3% chance of exploitation in the next 30 days. The Approval app's approve/reject endpoint is meant to require the file's current etag as a freshness check, preventing an approver from approving or rejecting a file whose contents changed after…
CVE-2025-66515, published 2025-12-05. Low severity, CVSS 2.7. EPSS: 0.3% chance of exploitation in the next 30 days. The Nextcloud Approval app allows approval or disapproval of files in the sidebar. Prior to 1.3.1 and 2.5.0, an authenticated user listed as a requester in a workflow can set another user’s file into…
CVE-2026-45277, published 2026-06-01. Low severity, CVSS 3.3. EPSS: 0.2% chance of exploitation in the next 30 days. Nextcloud is an open source content collaboration platform. Prior to version 2.7.2, authenticated users can check if arbitrary files are associated with specific approval workflows where they can…