The vulnerability allows an authenticated user to discover whether any arbitrary file is linked to an approval workflow in Nextcloud’s Approval app. By supplying a file identifier via the exposed parameter, an attacker can learn which workflows apply to that file, revealing sensitive metadata about internal processes. This is a classic information‑disclosure weakness (CWE‑200) and does not provide access to the file contents or other system functions.

Nextcloud users running the Approval app before version 2.7.2 are affected. The issue was fixed in the 2.7.2 release, so any deployment of earlier versions is vulnerable.

The CVSS score of 3.3 denotes low severity; the flaw is exploitable only by authenticated users, suggesting the attack vector involves a legitimate session within the application. Because the EPSS score is unavailable and the vulnerability is not listed in the CISA KEV catalog, there is no known widespread exploitation. However, any user with administrative or normal access could use the exposed API to enumerate approval workflow associations.