Bypass Vulnerability in Approval App by Vendor

CVE-2026-82982

What is CVE-2026-82982?

The Approval app contains a vulnerability in its approve/reject endpoint, which is designed to ensure the integrity of file approvals by requiring a valid etag as a freshness check. However, this check is only enforced if the etag parameter is included and populated in the request. An attacker who can intercept and alter the approval request may bypass this freshness check entirely by omitting the etag parameter, allowing them to approve or reject file versions without reviewing the associated content changes. This flaw poses significant risks to the approval process, leading to unauthorized actions that compromise the integrity of file management.

References