CVE-2025-66515
📋 TL;DR
This vulnerability in Nextcloud Approval app allows authenticated users listed as requesters in workflows to mark other users' files as 'pending approval' without having access to those files, using only the numeric file ID. This affects Nextcloud instances using Approval app versions before 1.3.1 or 2.5.0 where workflow features are enabled.
💻 Affected Systems
- Nextcloud Approval app
📦 What is this software?
Approval by Nextcloud
Approval by Nextcloud
⚠️ Risk & Real-World Impact
Worst Case
An attacker could disrupt business workflows by marking critical files as pending approval, potentially delaying important processes or creating confusion about file status.
Likely Case
Limited workflow disruption where users find their files unexpectedly marked for approval, requiring manual intervention to correct.
If Mitigated
Minimal impact with proper access controls and monitoring, as the vulnerability doesn't allow file access or modification.
🎯 Exploit Status
Exploitation requires authenticated access and knowledge of file IDs, but the technique is straightforward once those conditions are met.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.3.1 or 2.5.0
Vendor Advisory: https://github.com/nextcloud/security-advisories/security/advisories/GHSA-q26g-fmjq-x5g5
Restart Required: No
Instructions:
1. Update Nextcloud Approval app to version 1.3.1 or 2.5.0 via Nextcloud app store or manual installation. 2. Verify the update completed successfully. 3. No server restart required.
🔧 Temporary Workarounds
Disable Approval app
linuxTemporarily disable the Approval app if immediate patching isn't possible
occ app:disable approval
Restrict requester roles
allReview and limit users with requester roles in workflows to trusted personnel only
🧯 If You Can't Patch
- Implement strict access controls on who can be assigned as requesters in workflows
- Monitor approval workflow logs for unusual activity and file status changes
🔍 How to Verify
Check if Vulnerable:
Check Approval app version in Nextcloud admin settings or run: occ app:list | grep approvalCheck Version:
occ app:list | grep approvalVerify Fix Applied:
Confirm Approval app version is 1.3.1 or higher (for v1 branch) or 2.5.0 or higher (for v2 branch)📡 Detection & Monitoring
Log Indicators:
- Unexpected file status changes to 'pending approval'
- Approval requests from users not associated with the affected files
Network Indicators:
- API calls to approval endpoints with file IDs not owned by the requester
SIEM Query:
source="nextcloud.log" AND "pending approval" AND user!="file_owner"