Act nowKnown exploited

Advisory · CVE-2023-49105

Known ownCloud usernames unlock every file without a login

ownCloud core 10.6.0 through 10.13.0 accepts pre-signed URLs even when no signing key is configured, allowing unauthenticated access to any user's files.

Advisory published August 27, 2026Independent summary
Vendor
ownCloud
Product
ownCloud
Identifier / CWE
CVE-2023-49105
CWE-287
Action timing
Sep 17, 2026
ELI5

Explain it like I’m five

ownCloud leaves a spare key under every doormat by default, then accepts a photocopy of it. Know someone's username and you can open their whole house.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Username known

    The attacker only needs to know a victim's ownCloud username, which is often guessable or enumerated.

  2. 02No signing key

    The victim has no signing key configured, which is the default state, so there is nothing to validate against.

  3. 03Pre-signed URL forged

    The attacker crafts a pre-signed WebDAV URL for the victim's files; ownCloud accepts it anyway.

  4. 04Full file access

    Files can be accessed, modified, or deleted with no authentication at all.

What happened

CISA added CVE-2023-49105 to the Known Exploited Vulnerabilities catalog on August 27, 2026, nearly three years after the flaw was disclosed and fixed. ownCloud core 10.6.0 through 10.13.0 is affected.

Pre-signed URLs can be accepted even when no signing key is configured for the owner of the files, and having no signing key is the default configuration. An attacker who knows a victim’s username can therefore access, modify, or delete any of that user’s files through the WebDAV API without authenticating. The vulnerability is scored CVSS 9.8, unauthenticated, with no user interaction required. ownCloud fixed it in 10.13.1 by denying the use of pre-signed URLs when no signing key is configured.

The KEV listing in 2026 strongly suggests that unpatched ownCloud 10 instances are still reachable on the internet and are being actively targeted long after the fix shipped.

What to do

  1. Upgrade any ownCloud 10 deployment to 10.13.1 or later immediately.
  2. Inventory internet-facing ownCloud instances; these legacy deployments are the ones attackers are finding.
  3. Review WebDAV and access logs for unauthenticated requests touching files, especially for users whose usernames are public or guessable.
  4. If suspicious access is found, treat stored data as exposed: rotate credentials and assess what sensitive files lived on the instance.
  5. Plan migration off ownCloud 10, which is a legacy line, toward a supported platform.

Management note

This is a 2023 vulnerability landing on the 2026 exploited list, which tells you everything about the target: forgotten file-sharing servers nobody remembered to patch. The fix has existed for years, so exploitation now is purely a hygiene failure. The strategic question is not how to patch one server but how many other legacy self-hosted services are sitting unpatched on your perimeter.