What is the CVSS score of CVE-2026-45275?

CVE-2026-45275 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-45275?

Yes, a patch is available for CVE-2026-45275. Update the affected software to the latest version immediately.

Nextcloud Approval CVE-2026-45275

EUVD-2026-33702 MEDIUM

Improper Authorization (CWE-285)

2026-06-01 GitHub_M

Authentication Bypass Privilege Escalation Nextcloud

6.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Jun 01, 2026 - 20:02 EUVD

Source Code Evidence Fetched

Jun 01, 2026 - 19:34 vuln.today

Analysis Generated

Jun 01, 2026 - 19:34 vuln.today

DescriptionGitHub Advisory

Nextcloud is an open source content collaboration platform. Prior to version 2.7.2, a privilege escalation vulnerability exists in the Approval app that allows a user without sharing permissions to force the system to share a file with approvers. This results in an authorization bypass and privilege escalation, allowing unauthorized distribution of restricted files. This issue has been patched in version 2.7.2.

AnalysisAI

Privilege escalation in the Nextcloud Approval app (prior to version 2.7.2) allows authenticated users who lack sharing permissions to force the platform to distribute restricted files to approval workflow participants. By invoking the approval request flow with the createShares flag enabled, a user can bypass the system's file-sharing authorization controls entirely, causing files marked as non-shareable to be shared with designated approvers. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Authenticate as low-privileged user

Delivery

Identify restricted file with no share rights

Exploit

Invoke approval request with createShares=true

Execution

Authorization check bypassed in ApprovalService.php

Persist

System creates shares with approvers

Impact

Restricted file contents exposed to unauthorized parties

Access

Authenticate as low-privileged user

Delivery

Identify restricted file with no share rights

Exploit

Invoke approval request with createShares=true

Execution

Authorization check bypassed in ApprovalService.php

Persist

System creates shares with approvers

Impact

Restricted file contents exposed to unauthorized parties

Vulnerability AssessmentAI

Exploitation	The attacker must be an authenticated Nextcloud user (CVSS PR:L confirmed). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) scores 6.5 (Medium), indicating a network-reachable attack requiring only low-privilege authentication with no complexity or user interaction needed. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An authenticated Nextcloud user (e.g., a read-only collaborator on a confidential HR document) navigates to the Approval app and initiates an approval request for the file with the createShares option enabled. Because the pre-patch code does not verify sharing permissions, the system automatically creates shares of the restricted file with all configured approvers - users who were never intended to access the document. …
Remediation	Upgrade the Nextcloud Approval app to version 2.7.2 or later, which introduces a userCanShareFile() authorization check in ApprovalService.php before any share creation is permitted during approval workflows. … Detailed patch versions, workarounds, and compensating controls in full report.