CVE-2025-66515

Katalog CVE

CVSS 2.7 · Low EPSS 0,31%

Kerentanan Improper Authentication pada nextcloud approval. Skor CVSS 3.1 2.7 (Low) menurut github.com.

Deskripsi (NVD)

The Nextcloud Approval app allows approval or disapproval of files in the sidebar. Prior to 1.3.1 and 2.5.0, an authenticated user listed as a requester in a workflow can set another user’s file into the “pending approval” without access to the file by using the numeric file id. This vulnerability is fixed in 1.3.1 and 2.5.0.

Rincian

Terbit di NVD

5 Desember 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

2.7 (Low), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-287: Improper Authentication

EPSS (30 hari)

0,31% peluang dieksploitasi; lebih tinggi dari 22,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-q26g-fmjq-x5g5 patch · advisory vendor
• https://hackerone.com/reports/3338748 issue tracking · advisory vendor
• https://github.com/nextcloud/approval/commit/e30b56b7832255311ac800b7875f44866e88fff4 patch
• https://github.com/nextcloud/approval/pull/334 issue tracking