{"id":"owncloud-webdav-authentication-bypass-aug-2026","category":"patch","status":"closed","title":"ownCloud file-access bypass CVE-2023-49105 exploited despite fixes available since 2023","tldr":"Attackers are using an old ownCloud Server flaw to steal files without a password. Versions 10.6.0–10.13.0 are affected. Ask the server administrator to update; ownCloud's later guidance recommends 10.13.3 or a support patch.","summary":"CVE-2023-49105 lets an attacker who knows an ownCloud username read, change or delete that user's files without a password when the account has no signing key, which is the default. ownCloud lists Server core versions 10.6.0–10.13.0 as affected. Its 10.13.1 release announcement included the fix; later vendor guidance recommended upgrading to 10.13.3 or obtaining a support patch. Infinite Scale and ownCloud's managed services are unaffected. In August 2026, Hunt.io reported exploitation against a Philippine nuclear research body, finding stolen nuclear-related documents, staff information and credential stores on attacker infrastructure. CERT-PH coordinated notification to affected organisations. CISA listed the flaw as exploited on 27 August. As at 3 November 2026, the reviewed reporting does not establish when the intrusion began or whether the affected server has since been secured. The software fix is available; the reported theft has no confirmed public resolution in those sources.","action":"If your family or business stores files on ownCloud, ask whoever runs the server to confirm it is updated; ownCloud's later guidance specifies Server 10.13.3 or its support patch. The server administrator must apply the fix—updating the phone or desktop app does not update the server.","product":"ownCloud Server","audience":"work","severity":"critical","patch":"patched","exploited":true,"cves":["CVE-2023-49105"],"tags":["owncloud","file-sharing","authentication-bypass","data-theft","actively-exploited"],"affected":["ownCloud Server core 10.6.0–10.13.0; exploitation requires a known username and no signing key configured for that account."],"fixed":["ownCloud Server 10.13.1: initial fix documented in the vendor's release announcement.","ownCloud Server 10.13.3: upgrade specified in the vendor's later CVE-2023-49105 guidance; a support patch is also available to subscription customers."],"matches":[],"sources":[{"kind":"advisory","title":"WebDAV Api Authentication Bypass using Pre-Signed URLs","url":"https://owncloud.com/security-advisories/webdav-api-authentication-bypass-using-pre-signed-urls/","by":"ownCloud","date":"2023-11-21"},{"kind":"post","title":"ownCloud Server 10.13.1 released: Critical security fixes included","url":"https://central.owncloud.org/t/owncloud-server-10-13-1-released-critical-security-fixes-included/45223","by":"ownCloud","date":"2023-09-19"},{"kind":"post","title":"Immediate Action Required: Critical Security Updates for ownCloud","url":"https://owncloud.com/blogs/immediate-action-required-critical-security-updates-for-owncloud/","by":"ownCloud","date":"2023-12-01"},{"kind":"research","title":"Philippine Nuclear Agency and Naval Contractor Targeted by Suspected Chinese-Speaking Operator Using Known Vulnerabilities","url":"https://hunt.io/blog/chinese-speaking-operator-philippine-nuclear-naval-contractor","by":"Hunt.io","date":"2026-08-26"},{"kind":"news","title":"ownCloud Flaw Exploited to Steal Nuclear Records From Philippine Research Body","url":"https://thehackernews.com/2026/08/snowflake-github-actions-flaw-lets.html","by":"The Hacker News","date":"2026-08-28"}],"started":"2026-08-27","closed":"2026-08-27","created":"2026-11-03T22:13:49.901Z","updated":"2026-11-03T22:13:49.901Z","cve_notes":[{"cve":"CVE-2023-49105","name":"ownCloud WebDAV file-access authentication bypass","what":"ownCloud Server's WebDAV interface accepts pre-signed file requests for accounts without an initialised signing key, allowing someone who knows a username to read, alter or delete that user's files without signing in.","severity":"high","cvss":9.8}],"timeline":[{"at":"2026-08-27","added":"2026-11-03T22:11:23.504Z","kind":"cisa-added","text":"CISA added CVE-2023-49105 to its Known Exploited Vulnerabilities catalogue, as reported by The Hacker News. The federal civilian agency remediation deadline was 30 August 2026.","url":"https://thehackernews.com/2026/08/snowflake-github-actions-flaw-lets.html","by":"The Hacker News","patch":null},{"at":"2026-08-26","added":"2026-11-03T22:11:23.504Z","kind":"wider-attacks","text":"Hunt.io publicly linked the theft to CVE-2023-49105 and reported finding 176 files totalling approximately 372 MB from the nuclear research body. It said CERT-PH had coordinated notification to the affected organisations before publication.","url":"https://hunt.io/blog/chinese-speaking-operator-philippine-nuclear-naval-contractor","by":"Hunt.io","patch":null},{"at":"2026-08-13","added":"2026-11-03T22:11:23.504Z","kind":"other","text":"Hunt.io discovered an exposed attacker server containing evidence of file theft from a Philippine nuclear research body's ownCloud installation. The discovery date does not establish when the intrusion began.","url":"https://hunt.io/blog/chinese-speaking-operator-philippine-nuclear-naval-contractor","by":"Hunt.io","patch":null},{"at":"2023-12-01","added":"2026-11-03T22:11:23.504Z","kind":"vendor-revised","text":"ownCloud's follow-up guidance specifically recommended Server 10.13.3 or a patch from its support team for CVE-2023-49105. It said Infinite Scale and its managed services, including ownCloud.Online, were unaffected.","url":"https://owncloud.com/blogs/immediate-action-required-critical-security-updates-for-owncloud/","by":"ownCloud","patch":null},{"at":"2023-11-21","added":"2026-11-03T22:11:23.504Z","kind":"disclosed","text":"ownCloud published its WebDAV authentication-bypass advisory, listing core versions 10.6.0–10.13.0 as affected. Someone who knows a username can read, change or delete that user's files without signing in if the account has no signing key, the default setting.","url":"https://owncloud.com/security-advisories/webdav-api-authentication-bypass-using-pre-signed-urls/","by":"ownCloud","patch":null},{"at":"2023-09-19","added":"2026-11-03T22:11:23.504Z","kind":"new-fix","text":"ownCloud announced Server 10.13.1 with critical security fixes, including blocking pre-signed file access when the signing key had not been initialised.","url":"https://central.owncloud.org/t/owncloud-server-10-13-1-released-critical-security-fixes-included/45223","by":"ownCloud","patch":"patched"}],"url":"https://hard.fyi/live/owncloud-webdav-authentication-bypass-aug-2026/","json":"https://hard.fyi/api/live?id=owncloud-webdav-authentication-bypass-aug-2026"}