CVE-2026-45277

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-45277", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-11T18:41:13.157Z", "datePublished": "2026-06-01T16:51:34.087Z", "dateUpdated": "2026-06-01T21:43:17.556Z"}, "containers": {"cna": {"title": "Nextcloud: Information disclosure in Nextcloud Approval app via fileId parameter reveals workflow associations", "problemTypes": [{"descriptions": [{"cweId": "CWE-200", "lang": "en", "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 3.3, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-h7gm-vgxr-9hcw", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-h7gm-vgxr-9hcw"}, {"name": "https://github.com/nextcloud/approval/pull/356", "tags": ["x_refsource_MISC"], "url": "https://github.com/nextcloud/approval/pull/356"}, {"name": "https://hackerone.com/reports/3475210", "tags": ["x_refsource_MISC"], "url": "https://hackerone.com/reports/3475210"}], "affected": [{"vendor": "nextcloud", "product": "security-advisories", "versions": [{"version": "< 2.7.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-01T16:51:34.087Z"}, "descriptions": [{"lang": "en", "value": "Nextcloud is an open source content collaboration platform. Prior to version 2.7.2, authenticated users can check if arbitrary files are associated with specific approval workflows where they can request approval. This issue has been patched in version 2.7.2."}], "source": {"advisory": "GHSA-h7gm-vgxr-9hcw", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-01T21:43:07.958628Z", "id": "CVE-2026-45277", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-01T21:43:17.556Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-45277", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-01T21:43:07.958628Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-01T21:43:11.839Z"}}], "cna": {"title": "Nextcloud: Information disclosure in Nextcloud Approval app via fileId parameter reveals workflow associations", "source": {"advisory": "GHSA-h7gm-vgxr-9hcw", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.3, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "nextcloud", "product": "security-advisories", "versions": [{"status": "affected", "version": "< 2.7.2"}]}], "references": [{"url": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-h7gm-vgxr-9hcw", "name": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-h7gm-vgxr-9hcw", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/nextcloud/approval/pull/356", "name": "https://github.com/nextcloud/approval/pull/356", "tags": ["x_refsource_MISC"]}, {"url": "https://hackerone.com/reports/3475210", "name": "https://hackerone.com/reports/3475210", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Nextcloud is an open source content collaboration platform. Prior to version 2.7.2, authenticated users can check if arbitrary files are associated with specific approval workflows where they can request approval. This issue has been patched in version 2.7.2."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-200", "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-01T16:51:34.087Z"}}}, "cveMetadata": {"cveId": "CVE-2026-45277", "state": "PUBLISHED", "dateUpdated": "2026-06-01T21:43:17.556Z", "dateReserved": "2026-05-11T18:41:13.157Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-06-01T16:51:34.087Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "security-advisories", "vendor": "nextcloud", "versions": [{"status": "affected", "version": "< 2.7.2"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:nextcloud:approval:*:*:*:*:*:nextcloud:*:*", "matchCriteriaId": "571B6557-A744-42A4-B00C-59172782ADA1", "versionEndExcluding": "2.7.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Nextcloud is an open source content collaboration platform. Prior to version 2.7.2, authenticated users can check if arbitrary files are associated with specific approval workflows where they can request approval. This issue has been patched in version 2.7.2."}, {"lang": "es", "value": "Nextcloud es una plataforma de colaboraci\u00f3n de contenido de c\u00f3digo abierto. Antes de la versi\u00f3n 2.7.2, los usuarios autenticados pod\u00edan verificar si archivos arbitrarios estaban asociados con flujos de trabajo de aprobaci\u00f3n espec\u00edficos donde pod\u00edan solicitar aprobaci\u00f3n. Este problema ha sido parcheado en la versi\u00f3n 2.7.2."}], "id": "CVE-2026-45277", "lastModified": "2026-07-22T07:10:00.107", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 3.3, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-45277", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-01T21:43:07.958628Z", "version": "2.0.3"}}]}, "published": "2026-06-01T19:16:49.677", "references": [{"source": "security-advisories@github.com", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/nextcloud/approval/pull/356"}, {"source": "security-advisories@github.com", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-h7gm-vgxr-9hcw"}, {"source": "security-advisories@github.com", "tags": ["Permissions Required"], "url": "https://hackerone.com/reports/3475210"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.7.2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "security-advisories", "source": "cna", "vendor": "nextcloud"}, "product": "approval", "vendor": "nextcloud"}], "created": "2026-06-01T21:45:22.618451+00:00", "updated": "2026-06-03T19:00:17.503833+00:00", "vendors": ["nextcloud", "nextcloud$PRODUCT$approval"]}