🎯 New Report #3610332: Approval app's file-freshness check can be bypassed by omitting the etag parameter, allowing approval of unreviewed file changes
🔺Severity: Medium
👽 Reporter: vidang04
⭐️ Reputation: 593
🛠 State: resolved
💼 Team: Nextcloud
💵 Bounty: null
🕐 Submitted: 2026-03-17
⏰ Disclosed: 2026-09-17 10:34:47
📝 Summary: A vulnerability was discovered in the approval app's file-freshness check. The vulnerability allowed bypassing the check by omitting the etag parameter, enabling approval of unreviewed file changes. This broke the integrity of the approval process, as the approver could approve a different file state than the one they reviewed.
📂 Report JSON File: 3610332
@hackeronereports