CVE-2026-45277 Nextcloud: Information disclosure in Nextcloud Approval app via fileId parameter reveals workflow associations
Authenticated users can reveal workflow associations for arbitrary files via the fileId parameter in the Nextcloud Approval app.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-45277?
CVE-2026-45277 is a low-severity vulnerability in nextcloud security-advisories, published on 1 Jun 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Nextcloud is an open source content collaboration platform. Prior to version 2.7.2, authenticated users can check if arbitrary files are associated with specific approval workflows where they can request approval. This issue has been patched in version 2.7.2.
Weakness: CWE-200
Which versions are affected by CVE-2026-45277?
It affects 1 product.
Products include Nextcloud Approval.
How do I fix CVE-2026-45277?
No fix has been published for CVE-2026-45277 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-45277 being exploited?
There is no known exploitation of CVE-2026-45277 in the wild and no public exploit code.
Other vulnerabilities in nextcloud security-advisories
Sources
Also known as GHSA-h7gm-vgxr-9hcw.