Nextcloud Approval CVE-2026-45275

The attacker must be an authenticated Nextcloud user (CVSS PR:L confirmed). They must have read access to a target file but explicitly lack sharing permissions on it - the scenario where a file owner or admin shared a file without granting re-share rights. The Nextcloud Approval app must be installed and enabled on the instance. The attacker must trigger the approval request endpoint with the createShares parameter set to true. Exploitation is limited by: requirement of valid Nextcloud credentials, the Approval app must be installed and the user must have permission to initiate approval workflows, and the target file must exist in a context where the user has file access but not sharing rights. Default Nextcloud installations without the Approval app are entirely unaffected.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) scores 6.5 (Medium), indicating a network-reachable attack requiring only low-privilege authentication with no complexity or user interaction needed. The confidentiality impact is High with no integrity or availability impact, consistent with unauthorized file disclosure rather than modification. No EPSS score was provided in the intelligence data, limiting probabilistic exploitation assessment. This vulnerability is not listed in CISA KEV, and no public exploit code has been identified at time of analysis. Despite the Medium CVSS, the real-world risk is meaningful for organizations using Nextcloud Approval workflows on sensitive documents: any low-privileged user with read access to a restricted file can weaponize the approval flow to leak it. The attack requires only authenticated access - a common condition in collaborative platforms. The scope is bounded to the Approval app; instances not running this app are unaffected.

An authenticated Nextcloud user (e.g., a read-only collaborator on a confidential HR document) navigates to the Approval app and initiates an approval request for the file with the createShares option enabled. Because the pre-patch code does not verify sharing permissions, the system automatically creates shares of the restricted file with all configured approvers - users who were never intended to access the document. The approvers receive access notifications and can now read the file contents without the file owner's knowledge or consent.