CVE-2026-82982: Medium severity Approval app vulnerability
The Approval app's approve/reject endpoint is meant to require the file's current etag as a freshness check, preventing an approver from approving or rejecting a file whose contents changed after they reviewed it. The backend only enforced this check when the etag parameter was present and non-empty in the request. An attacker able to intercept and modify the approval request could omit the etag field entirely, bypassing the freshness check and approving or rejecting a file version they never reviewed.
Affected Software
Event History
Frequently Asked Questions
What access and capabilities are needed to exploit this issue?
An attacker needs privileges to submit approval or rejection requests and must be able to intercept and modify the approval request before it reaches the backend. They can exploit the issue by removing the etag parameter or sending it empty.
What is the practical impact?
The attacker can approve or reject a file whose contents changed after the approver reviewed it. The issue affects integrity of the approval workflow; no confidentiality or availability impact is described.
How can teams reduce risk if they cannot apply a fix immediately?
Ensure approval requests cannot be modified in transit and monitor approval or rejection activity involving files that changed after review. Validate that requests include a non-empty etag before allowing the approval action.