EUVD-2026-82619
GHSA-w4mj-3r4x-wxm3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as approver in Approval app
-
DeliveryIntercept/craft approve-reject request
-
ExploitOmit etag freshness parameter
-
ExecutionBypass version check on backend
-
ImpactApprove/reject unreviewed file version
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V2 - Validation and Business Logic Business logic errors
|
| Exploitation Conditions | Requires an authenticated user with approve/reject privileges in the Nextcloud Approval app, or an attacker positioned to modify that approver's outbound approve/reject HTTP request. The specific trigger is omitting the etag parameter entirely (or sending it empty), because the backend only enforced the etag freshness check when the parameter was present and non-empty. Limiting factors: the Approval app must be installed and in active use, the attacker needs approver-level authorization (PR:L), and impact is confined to approving/rejecting a file version that changed after review - integrity-only, with no confidentiality or availability effect and no scope change. |
| Impact | This is a genuinely low-priority issue and the signals are consistent, not conflicting. The vendor CVSS 3.0 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N = 4.3) describes an authenticated (PR:L), integrity-only (I:L), no-confidentiality, no-availability weakness - a business-logic freshness-check bypass (CWE-840), not remote code execution or data theft. There is no EPSS score, no CISA KEV listing, and no public exploit code in the provided data - the sole reference is a HackerOne report (#3610332), which indicates responsible disclosure rather than in-the-wild exploitation. Per the input signals this is 'no public exploit identified at time of analysis.' The one caveat worth flagging: the description frames the attacker as someone who can 'intercept and modify the approval request,' implying a man-in-the-middle or a malicious/curious approver, yet the CVSS uses PR:L (an authenticated approver) with S:U - the realistic actor is simply an authenticated approver who strips the etag field, so no true MITM position is strictly required. Net: real but minor integrity bug, correctly rated low; not an urgent patch priority absent a threat model where unreviewed approvals carry high business consequence. |
| Exploit ScenarioDerived | An authenticated Nextcloud user with approver rights (or someone able to tamper with the approver's outbound request) submits an approve/reject action but omits the etag parameter entirely. Because the backend only validated freshness when etag was present and non-empty, the file version check is skipped and a file whose contents changed after review is approved or rejected. No public exploit code is identified; exploitation is a trivial request modification requiring low attack complexity. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 18, 2026
Approval bypass in the Nextcloud Approval app allows an authenticated user holding approve/reject privileges - or an attacker positioned to intercept and modify that approver's outbound approve/reject HTTP request - to approve or reject a file version whose contents changed after the approver reviewed it, simply by omitting or blanking the etag parameter. The backend only applied its etag freshness check when the parameter was present and non-empty, so the review-integrity control is skippable; impact is limited to integrity of the approval decision (CVSS 4.3, PR:L, no confidentiality or availability effect). No public exploit code was identified at time of analysis, and this is assessed as a genuinely low-priority issue whose signals are consistent.
RemediationAI
No vendor-released patch version is identified in the available input data, so the primary action is to track the disclosure record at https://hackerone.com/reports/3610332 and the Nextcloud security advisories for the Approval app and apply the fixed release as soon as it is published; do not treat any specific version number as the fix until confirmed by the vendor. Until then, the most reliable compensating control is a server-side change to the approve/reject handler that treats a missing or empty etag as a hard validation failure instead of skipping the comparison - a backend patch or upstream commit is required, and its trade-off is a custom code change that must be maintained across upgrades. Administrators can reduce exposure by restricting approve/reject privileges to a small, trusted set of accounts (trade-off: slows approval workflows and increases admin overhead) and by disabling the Approval app entirely if it is not in active use (trade-off: loss of the approval workflow feature). Enforcing TLS with integrity protection for the Nextcloud front end raises the bar for request tampering but is not a complete mitigation when the attacker is already positioned to modify authenticated traffic, and it does not address an approver who deliberately crafts a parameter-less request; logging and alerting on approve/reject requests lacking an etag can help detect abuse but is detective, not preventive.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The Approval app is a Nextcloud workflow component whose approve/reject endpoint is designed to compare a client-supplied entity tag (etag, typically the file's content hash/version identifier) against the file's current etag before committing an approval decision, ensuring an approver only acts on the exact revision they reviewed. The defect is a business-logic validation flaw classified as CWE-840 (Business Logic Errors): the handler gated the freshness comparison behind a check that only ran when the etag parameter was present and non-empty, so an absent or empty value silently skipped validation rather than being rejected. Per the CPE string cpe:2.3:a:nextcloud:approval:*:*:*:*:*:*:*:*, all versions tracked by the wildcard are in scope; the vector CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N (consistent with the assessed CVSS:3.1 vector) confirms a network-reachable endpoint requiring low privileges, no user interaction, no scope change, and integrity-only impact. The relevant technology is HTTP request validation over the Nextcloud file/workflow API, where a monitor-in-the-middle or a user able to craft the request can strip a parameter that the server treats as optional.
Know when Approval gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Authenticated approver over the network (PR:L, AV:N) trivially omits the etag field (AC:L); only integrity of the approval decision is affected (I:L), no confidentiality or availability impact and no scope change.
Primary rating from Vendor (hackerone).
CVSS VectorVendor: hackerone
DescriptionCVE.org
The Approval app's approve/reject endpoint is meant to require the file's current etag as a freshness check, preventing an approver from approving or rejecting a file whose contents changed after they reviewed it. The backend only enforced this check when the etag parameter was present and non-empty in the request. An attacker able to intercept and modify the approval request could omit the etag field entirely, bypassing the freshness check and approving or rejecting a file version they never reviewed.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
Exploit-DB