Nextcloud Approval Workflow Association Disclosure Vulnerability

A vulnerability exists in the Nextcloud Approval app, affecting versions prior to 2.7.2. Authenticated users can determine if specific files are linked to particular approval workflows, allowing them to request approval for those files. This issue has been addressed in version 2.7.2.

Impact

Exploitation of this vulnerability allows authenticated users to access information about workflow associations of arbitrary files, potentially leading to unauthorized approval requests.

Remediation

Users are advised to upgrade the Nextcloud Approval app to version 2.7.2. Alternatively, the Approval app can be disabled.