CVE-2026-82982

Overview

The Approval app's approve and reject endpoint contains an insufficient validation flaw in its freshness check mechanism. By omitting the etag parameter entirely from the request, an attacker can bypass content verification. This allows the unauthorized approval or rejection of file versions that were never actually reviewed.

Description

The Approval app's approve/reject endpoint is meant to require the file's current etag as a freshness check, preventing an approver from approving or rejecting a file whose contents changed after they reviewed it. The backend only enforced this check when the etag parameter was present and non-empty in the request. An attacker able to intercept and modify the approval request could omit the etag field entirely, bypassing the freshness check and approving or rejecting a file version they never reviewed.

Impact

This vulnerability impacts data integrity and workflow control within the application, affecting organizations relying on strict file review processes. An authenticated user with interception capabilities could force state changes on modified files without validation. The confidentiality and availability of the system remain unaffected.

Remediation

Update the backend logic to mandate the presence and validity of the etag parameter for all approval and rejection requests. Ensure that missing or empty etag fields are explicitly rejected by the server rather than skipping the freshness check. Conduct code reviews on state-changing endpoints to enforce strict input validation.

Risk context

Rated as a medium severity vulnerability with a CVSS v3 score of 4.3, though EPSS data is currently unavailable. The risk is constrained by the requirement to intercept requests and manipulate stateful review workflows. Defenders should prioritize patching during the next standard maintenance cycle.

Affected products

• Approval App