A privilege escalation flaw exists in the Nextcloud Approval app that allows a user lacking file‑sharing rights to force the system to share a file with approvers. The vulnerability is a classic authorization bypass described by CWE‑285, resulting in unauthorized distribution of restricted files and loss of confidentiality for the owners of those files.

Any Nextcloud instance that has the Approval app installed and running a version earlier than 2.7.2 is affected. The vulnerability applies to the Approval app component of the Nextcloud platform, regardless of the underlying operating system or database. Users should check the app version in the Nextcloud app store or the admin dashboard.

The vulnerability scored 6.5 on the CVSS scale, indicating a moderate risk level. EPSS information is not available, so the exact likelihood of exploitation cannot be quantified, but the flaw is listed in a public advisory and relies on normal web interface interaction. Because it is not currently included in the CISA KEV catalog, no public exploits have been reported yet. An attacker who can log into the Approval app with limited permissions can craft a request that triggers the bypass; the attack can be carried out while the user is authenticated to the Nextcloud instance and requires no additional privilege escalation beyond the existing user credentials.