CVE-2026-45275: Nextcloud: Authorization bypass in approval feature allows unauthorized file sharing with approvers
Nextcloud is an open source content collaboration platform. Prior to version 2.7.2, a privilege escalation vulnerability exists in the Approval app that allows a user without sharing permissions to force the system to share a file with approvers. This results in an authorization bypass and privilege escalation, allowing unauthorized distribution of restricted files. This issue has been patched in version 2.7.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
nextcloud/nextcloudto a version that resolves this vulnerability.Fixed in 2.7.2
Event History
Frequently Asked Questions
What is the severity of CVE-2026-45275?
The severity of CVE-2026-45275 is rated as medium with a score of 6.5.
What is CVE-2026-45275 about?
CVE-2026-45275 involves an authorization bypass in the Nextcloud Approval feature that allows unauthorized file sharing with approvers.
How do I fix CVE-2026-45275?
The fix for CVE-2026-45275 is to update Nextcloud to version 2.7.2 or later where a patch is available.
Who is affected by CVE-2026-45275?
Users of Nextcloud prior to version 2.7.2 with the Approval app installed are affected by CVE-2026-45275.
What can happen if CVE-2026-45275 is exploited?
Exploitation of CVE-2026-45275 allows unauthorized users to share files with approvers, bypassing standard sharing permission restrictions.