Approval
Monthly
Approval bypass in the Nextcloud Approval app allows an authenticated user holding approve/reject privileges - or an attacker positioned to intercept and modify that approver's outbound approve/reject HTTP request - to approve or reject a file version whose contents changed after the approver reviewed it, simply by omitting or blanking the etag parameter. The backend only applied its etag freshness check when the parameter was present and non-empty, so the review-integrity control is skippable; impact is limited to integrity of the approval decision (CVSS 4.3, PR:L, no confidentiality or availability effect). No public exploit code was identified at time of analysis, and this is assessed as a genuinely low-priority issue whose signals are consistent.
The Nextcloud Approval app allows approval or disapproval of files in the sidebar. Prior to 1.3.1 and 2.5.0, an authenticated user listed as a requester in a workflow can set another user’s file into the “pending approval” without access to the file by using the numeric file id. This vulnerability is fixed in 1.3.1 and 2.5.0.
Approval bypass in the Nextcloud Approval app allows an authenticated user holding approve/reject privileges - or an attacker positioned to intercept and modify that approver's outbound approve/reject HTTP request - to approve or reject a file version whose contents changed after the approver reviewed it, simply by omitting or blanking the etag parameter. The backend only applied its etag freshness check when the parameter was present and non-empty, so the review-integrity control is skippable; impact is limited to integrity of the approval decision (CVSS 4.3, PR:L, no confidentiality or availability effect). No public exploit code was identified at time of analysis, and this is assessed as a genuinely low-priority issue whose signals are consistent.
The Nextcloud Approval app allows approval or disapproval of files in the sidebar. Prior to 1.3.1 and 2.5.0, an authenticated user listed as a requester in a workflow can set another user’s file into the “pending approval” without access to the file by using the numeric file id. This vulnerability is fixed in 1.3.1 and 2.5.0.