CVE-2026-82982The Approval app's approve/reject endpoint is meant to require the file's current etag as a freshness check, preventing an approver from approving or rejecting a file whose contents changed after the…
Updated under an hour ago ()
Does this affect you?
It affects Nextcloud Approval. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
The Approval app's approve/reject endpoint is meant to require the file's current etag as a freshness check, preventing an approver from approving or rejecting a file whose contents changed after they reviewed it. The backend only enforced this check when the etag parameter was present and non-empty in the request. An attacker able to intercept and modify the approval request could omit the etag field entirely, bypassing the freshness check and approving or rejecting a file version they never reviewed.
- CVSS
- 4.3 MEDIUM (v3.0, CNA)CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- Weakness (CWE)
- CWE-840
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- hackerone
- NVD analysis
- Deferred
- Record last updated
- Sep 18, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Nextcloud Approval nextcloud:approval (from the name) | from 1.0.0 through 3.0.0 | CNA record |
References
- https://hackerone.com/reports/3610332
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.