What is the CVSS score of CVE-2026-45275?

CVE-2026-45275 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-45275?

Yes, a patch is available for CVE-2026-45275. Update the affected software to the latest version immediately.

Nextcloud Approval CVE-2026-45275

EUVD-2026-33702 MEDIUM

Improper Authorization (CWE-285)

2026-06-01 GitHub_M

Privilege Escalation Authentication Bypass Nextcloud Security Advisories

6.5

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from Vendor (GitHub_M) · only source for this CVE.

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Jun 01, 2026 - 20:02 EUVD

Source Code Evidence Fetched

Jun 01, 2026 - 19:34 vuln.today

Analysis Generated

Jun 01, 2026 - 19:34 vuln.today

DescriptionCVE.org

Nextcloud is an open source content collaboration platform. Prior to version 2.7.2, a privilege escalation vulnerability exists in the Approval app that allows a user without sharing permissions to force the system to share a file with approvers. This results in an authorization bypass and privilege escalation, allowing unauthorized distribution of restricted files. This issue has been patched in version 2.7.2.

AnalysisAI

Privilege escalation in the Nextcloud Approval app (prior to version 2.7.2) allows authenticated users who lack sharing permissions to force the platform to distribute restricted files to approval workflow participants. By invoking the approval request flow with the createShares flag enabled, a user can bypass the system's file-sharing authorization controls entirely, causing files marked as non-shareable to be shared with designated approvers. No public exploit has been identified at time of analysis, but a vendor-confirmed patch and upstream PR diff are available.

Technical ContextAI

The vulnerability resides in the Nextcloud Approval app's ApprovalService.php, specifically within the request() method responsible for initiating file approval workflows. The root cause is CWE-285 (Improper Authorization): when a user triggers an approval request with createShares=true, the code previously proceeded to create file shares with approvers without first verifying whether the requesting user held sharing permissions on that file. The fix introduced a new userCanShareFile() check in UtilsService.php that queries the file node's isShareable() property against the requesting user's folder context. Affected product is identified via CPE cpe:2.3:a:nextcloud:security-advisories:*:*:*:*:*:*:*:* - the Nextcloud Approval app running on any Nextcloud instance prior to app version 2.7.2. The underlying platform handles file permissions separately from the approval subsystem, and the app failed to enforce platform-level sharing restrictions at the authorization boundary.

RemediationAI

Upgrade the Nextcloud Approval app to version 2.7.2 or later, which introduces a userCanShareFile() authorization check in ApprovalService.php before any share creation is permitted during approval workflows. The upstream fix is documented in pull request #392 at https://github.com/nextcloud/approval/pull/392 and the security advisory at https://github.com/nextcloud/security-advisories/security/advisories/GHSA-v8q8-w6c3-3gv9. If immediate upgrade is not possible, a compensating control is to disable or restrict access to the Approval app for users who should not have sharing capabilities; however, this may disrupt legitimate approval workflows. Administrators can also audit current Nextcloud sharing permission assignments to ensure that users with access to sensitive files are not granted Approval app initiation rights until the patch is applied.