Nextcloud is a popular open-source platform that helps individuals and organizations manage and share their files securely. It’s like having your own personal cloud storage, giving you control over your data. Within Nextcloud, various applications enhance its functionality. One such application is the “Approval” app, designed to streamline workflows by requiring approvals for certain actions or documents. Recently, a minor security concern was identified in this app.
This vulnerability, tracked as CVE-2026-45277, affects the Nextcloud Approval app. It allowed authenticated users to gain some insight into whether specific files were tied to an approval process. While not a critical flaw, it’s important to understand and address any potential information leakage in your systems.
CVE Details
- Product Name: Nextcloud Approval app
- CVE ID: CVE-2026-45277
- Published Date: June 1, 2026
- Severity: Low
- Status: Analyzed
Affected Products
The information disclosure vulnerability impacts versions of the Nextcloud Approval app prior to version 2.7.2. If you are running an older version of the Approval app, your system may be susceptible to this issue.
Current Status
The vulnerability has been thoroughly analyzed by the Nextcloud team. A fix was developed and merged on January 8, 2026, and subsequently released in a patched version of the app. This means that users can address the vulnerability by updating their software.
Severity Level
This vulnerability is rated as "Low" severity. This classification is due to several factors:
- It requires an **authenticated user** to exploit. This means an attacker would already need valid login credentials to your Nextcloud instance.
- The vulnerability primarily leads to **information disclosure**. It allows an authenticated user to check if a file is associated with an approval workflow where they can request approval. It does not allow unauthorized modification of files, deletion of data, or full system compromise.
- The potential impact is limited to knowing which files are part of an approval process, rather than accessing the file content itself or manipulating the workflow without proper permissions.
Possible Solutions
To ensure the security of your Nextcloud instance and protect against this information disclosure vulnerability, it is crucial to update your Nextcloud Approval app. The issue has been patched in version 2.7.2.
We strongly recommend all users running affected versions of the Nextcloud Approval app to upgrade to version 2.7.2 or later as soon as possible. Regular software updates are a cornerstone of good cybersecurity hygiene and help keep your systems protected against known vulnerabilities.
References
- https://github.com/nextcloud/approval/pull/356
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-h7gm-vgxr-9hcw
- https://hackerone.com/reports/3475210
