ownCloud file-access bypass CVE-2023-49105 exploited despite fixes available since 2023
Attackers are using an old ownCloud Server flaw to steal files without a password. Versions 10.6.0–10.13.0 are affected. Ask the server administrator to update; ownCloud's later guidance recommends 10.13.3 or a support patch.
If your family or business stores files on ownCloud, ask whoever runs the server to confirm it is updated; ownCloud's later guidance specifies Server 10.13.3 or its support patch. The server administrator must apply the fix—updating the phone or desktop app does not update the server.
What’s happening
CVE-2023-49105 lets an attacker who knows an ownCloud username read, change or delete that user's files without a password when the account has no signing key, which is the default. ownCloud lists Server core versions 10.6.0–10.13.0 as affected. Its 10.13.1 release announcement included the fix; later vendor guidance recommended upgrading to 10.13.3 or obtaining a support patch. Infinite Scale and ownCloud's managed services are unaffected. In August 2026, Hunt.io reported exploitation against a Philippine nuclear research body, finding stolen nuclear-related documents, staff information and credential stores on attacker infrastructure. CERT-PH coordinated notification to affected organisations. CISA listed the flaw as exploited on 27 August. As at 3 November 2026, the reviewed reporting does not establish when the intrusion began or whether the affected server has since been secured. The software fix is available; the reported theft has no confirmed public resolution in those sources.
- What
- Flaw
- Affects
- ownCloud Server
- Affected
- ownCloud Server core 10.6.0–10.13.0; exploitation requires a known username and no signing key configured for that account.
- Fixed in
- ownCloud Server 10.13.1: initial fix documented in the vendor's release announcement.
ownCloud Server 10.13.3: upgrade specified in the vendor's later CVE-2023-49105 guidance; a support patch is also available to subscription customers. - Since
- 27 Aug 2026
- Closed
- 27 Aug 2026
Timeline
- CISA added
CISA added CVE-2023-49105 to its Known Exploited Vulnerabilities catalogue, as reported by The Hacker News. The federal civilian agency remediation deadline was 30 August 2026.
- Wider attacks
Hunt.io publicly linked the theft to CVE-2023-49105 and reported finding 176 files totalling approximately 372 MB from the nuclear research body. It said CERT-PH had coordinated notification to the affected organisations before publication.
- Update
Hunt.io discovered an exposed attacker server containing evidence of file theft from a Philippine nuclear research body's ownCloud installation. The discovery date does not establish when the intrusion began.
- Vendor revised
ownCloud's follow-up guidance specifically recommended Server 10.13.3 or a patch from its support team for CVE-2023-49105. It said Infinite Scale and its managed services, including ownCloud.Online, were unaffected.
- Made public
ownCloud published its WebDAV authentication-bypass advisory, listing core versions 10.6.0–10.13.0 as affected. Someone who knows a username can read, change or delete that user's files without signing in if the account has no signing key, the default setting.
- New fixFixed
ownCloud announced Server 10.13.1 with critical security fixes, including blocking pre-signed file access when the signing key had not been initialised.
Sources
- WebDAV Api Authentication Bypass using Pre-Signed URLsownCloud · 21 Nov 2023
- ownCloud Server 10.13.1 released: Critical security fixes includedownCloud · 19 Sept 2023
- Immediate Action Required: Critical Security Updates for ownCloudownCloud · 1 Dec 2023
- Philippine Nuclear Agency and Naval Contractor Targeted by Suspected Chinese-Speaking Operator Using Known VulnerabilitiesHunt.io · 26 Aug 2026
- ownCloud Flaw Exploited to Steal Nuclear Records From Philippine Research BodyThe Hacker News · 28 Aug 2026