CVE-2025-66515 LOW

CVE-2025-66515: Nextcloud Approval app allows users to request approval for other users file

Vendor Nextcloud
Product security-advisories
Weakness CWE-287 · Improper authentication
Published December 5, 2025
Last update December 5, 2025
View on NVD All CVEs

CVSS base score

2.7/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Confidentiality None
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

What the vulnerability does

01Description

The Nextcloud Approval app allows approval or disapproval of files in the sidebar. Prior to 1.3.1 and 2.5.0, an authenticated user listed as a requester in a workflow can set another user’s file into the “pending approval” without access to the file by using the numeric file id. This vulnerability is fixed in 1.3.1 and 2.5.0.

Key dates

02Disclosure timeline

December 5, 2025 CVE published
December 5, 2025 Record updated