CVE-2025-66515: The Nextcloud Approval app allows approval or disapproval of files in the sidebar. Prior to 1.3.1 and 2.5.0, an authenticated user listed as a requester in a…

PriorityP411low2.7CVSS 3.1

AVNACLPRHUINSUCNILAN

EPSS

0.26%

17.4th percentile

The Nextcloud Approval app allows approval or disapproval of files in the sidebar. Prior to 1.3.1 and 2.5.0, an authenticated user listed as a requester in a workflow can set another user’s file into the “pending approval” without access to the file by using the numeric file id. This vulnerability is fixed in 1.3.1 and 2.5.0.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
nextcloud	approval	>= 1.0.0 < 1.3.1	1.3.1
nextcloud	approval	>= 2.0.0 < 2.5.0	2.5.0
nextcloud	security-advisories	< 1.3.1	1.3.1
nextcloud	security-advisories	—	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.