CVE-2026-45275

Description

Nextcloud is an open source content collaboration platform. Prior to version 2.7.2, a privilege escalation vulnerability exists in the Approval app that allows a user without sharing permissions to force the system to share a file with approvers. This results in an authorization bypass and privilege escalation, allowing unauthorized distribution of restricted files. This issue has been patched in version 2.7.2.

Weakness classification

• security-advisories@github.com: CWE-285

Primary references

• security-advisories@github.com — Issue Tracking, Patch
• security-advisories@github.com — Mitigation, Vendor Advisory
• security-advisories@github.com — Permissions Required