What is the CVSS score of CVE-2026-45277?

CVE-2026-45277 has a CVSS 3.1 base score of 3.3 (Low). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-45277?

Yes, a patch is available for CVE-2026-45277. Update the affected software to the latest version immediately.

Nextcloud Approval CVE-2026-45277

EUVD-2026-33703 LOW

Information Exposure (CWE-200)

2026-06-01 GitHub_M

Information Disclosure Nextcloud

3.3

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

3.3 LOW

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Jun 01, 2026 - 20:02 EUVD

Source Code Evidence Fetched

Jun 01, 2026 - 19:34 vuln.today

Analysis Generated

Jun 01, 2026 - 19:34 vuln.today

DescriptionGitHub Advisory

Nextcloud is an open source content collaboration platform. Prior to version 2.7.2, authenticated users can check if arbitrary files are associated with specific approval workflows where they can request approval. This issue has been patched in version 2.7.2.

AnalysisAI

Information disclosure in the Nextcloud Approval app prior to version 2.7.2 allows authenticated users to enumerate whether arbitrary files are enrolled in approval workflows, regardless of their access rights to those files. The root cause (CWE-200) is a missing file-access authorization check in ApprovalService.php before workflow association queries are processed, confirmed by the patch diff in PR #356. No public exploit exists and no active exploitation is confirmed; the practical impact is limited to organizational workflow metadata leakage rather than file content exposure.

Technical ContextAI

The affected component is the Nextcloud Approval app, a Nextcloud plugin managing file-based approval workflows. The flaw resides in the getBasicUserRules() method of lib/Service/ApprovalService.php, which accepted a file ID parameter and returned workflow association data without first verifying whether the requesting user had read access to the referenced file. This creates an authorization oracle: by iterating numeric Nextcloud file IDs, an authenticated user can probe the approval subsystem and infer workflow membership for files they cannot access. The patch (PR #356) inserts a call to $this->utilsService->userHasAccessTo($fileId, $userId) before any workflow logic executes, throwing an InvalidArgumentException for unauthorized file IDs. CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) correctly classifies this as a missing pre-condition access control check. The CPE string cpe:2.3:a:nextcloud:security-advisories:*:*:*:*:*:*:*:* is a repository-level identifier; the specific affected artifact is the Nextcloud Approval app.

RemediationAI

Upgrade the Nextcloud Approval app to version 2.7.2 or later, which is confirmed as the vendor-released patch per the GitHub security advisory GHSA-h7gm-vgxr-9hcw. The fix is available in upstream PR #356 (https://github.com/nextcloud/approval/pull/356) and should be applied via the Nextcloud app store or manual update. No documented workarounds exist short of disabling the Approval app entirely if upgrade is not immediately possible - disabling the app eliminates the attack surface but also removes all approval workflow functionality. Administrators in sensitive deployments should prioritize this update even given the low CVSS score if workflow enrollment metadata is considered confidential organizational information.