CVE-2026-82982 Business logic in Approval
Attackers can bypass file freshness checks in Nextcloud Approval by omitting the etag, allowing approval of unreviewed file versions.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-82982?
CVE-2026-82982 is a medium-severity vulnerability in Nextcloud Approval, published on 18 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The Approval app's approve/reject endpoint is meant to require the file's current etag as a freshness check, preventing an approver from approving or rejecting a file whose contents changed after they reviewed it. The backend only enforced this check when the etag parameter was present and non-empty in the request. An attacker able to intercept and modify the approval request could omit the etag field entirely, bypassing the freshness check and approving or rejecting a file version they never reviewed.
Weakness: CWE-840
Which versions are affected by CVE-2026-82982?
How do I fix CVE-2026-82982?
No fix has been published for CVE-2026-82982 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-82982 being exploited?
There is no known exploitation of CVE-2026-82982 in the wild and no public exploit code.
Sources
Also known as GHSA-w4mj-3r4x-wxm3.