CVE-2025-66515

—

CVSS 3.1

2.7 low

EPSS

<1%p24

Published

Dec 5, 2025 (Dec 5, 2025)

Modified

Jun 17, 2026

Description

The Nextcloud Approval app allows approval or disapproval of files in the sidebar. Prior to 1.3.1 and 2.5.0, an authenticated user listed as a requester in a workflow can set another user’s file into the “pending approval” without access to the file by using the numeric file id. This vulnerability is fixed in 1.3.1 and 2.5.0.

Vendors: nextcloud
Products: approval
Weakness: CWE-287
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

NVD CVE.org GitHub PoCs EPSS (0.3%)

In the news0 stories

No ingested article mentions this CVE yet.