CVE-2023-49105: ownCloud WebDAV API Authentication Bypass via Pre-Signed URLs

Background

ownCloud is a self-hosted file sync, share, and collaboration platform, widely deployed by organizations that want cloud-drive functionality (file storage, sharing links, mobile sync, WebDAV access) without relying on a third-party SaaS provider. Its WebDAV API is a core integration surface — it’s how desktop sync clients, mobile apps, and third-party tools read and write files in a user’s ownCloud storage using standard HTTP verbs (PROPFIND, GET, PUT, DELETE, etc.).

A feature of ownCloud’s architecture allows WebDAV requests to be authenticated via pre-signed URLs — URLs that embed a cryptographic signature so that a request can be authenticated without a traditional session or basic-auth header, useful for generating shareable, time-limited, or app-integration links. CVE-2023-49105 undermines that mechanism directly: when a victim account has no signing key configured, the signature check that is supposed to gate pre-signed WebDAV access can be bypassed entirely.

Technical Mechanism

CVE-2023-49105 is classified under CWE-287 (Improper Authentication). The KEV shortDescription states plainly: the vulnerability “allows an attacker to access, modify, or delete any file without authentication if the username of a victim is known, and the victim has no signing-key configured.”

The attack flow works as follows:

1. ownCloud’s WebDAV pre-signed URL feature is designed to validate a request’s signature against a per-user signing key before granting access to that user’s files via the signed-URL code path.
2. If a given user account has never had a signing key provisioned (a legitimate and common state — not every account generates or rotates a signing key), the server-side validation logic does not correctly reject the request. Instead of failing closed when no key is available to verify against, the implementation effectively fails open for that account.
3. An attacker who knows (or guesses/enumerates) a valid username — not a password, not a token, not a session cookie — can construct a WebDAV request targeting that username’s pre-signed URL path and have it accepted as authenticated, because there is no signing key present to invalidate the forged signature.
4. Once accepted, the request is processed with the full file-access privileges of the targeted account against the standard WebDAV verbs: reading (GET/PROPFIND), writing (PUT), and deleting (DELETE) any file the victim account can access.

This is a textbook improper-authentication bypass: the authorization decision depends on an authentication check that can be trivially unsatisfied by an attacker, because the “no key configured” state was not treated as “deny,” but effectively as “allow.”

Real-World Exploitation Evidence

CVE-2023-49105 was added to CISA’s Known Exploited Vulnerabilities (KEV) catalog on 2026-08-27. KEV listing means CISA has confirmed evidence of active, real-world exploitation — this is not a theoretical or lab-only finding.

Regarding ransomware: the KEV record lists knownRansomwareCampaignUse as “Unknown.” CISA has not confirmed use of this vulnerability in ransomware campaigns at this time; this status should be read as “not yet documented,” not as “confirmed absent.”

No specific threat actor, intrusion set, or named campaign has been publicly attributed to exploitation of this CVE based on the data available. Its KEV listing confirms active exploitation in the wild, but attribution detail is not yet public. Given that this CVE was originally disclosed in late 2023 and only added to KEV in 2026, it is consistent with a pattern seen across many older, well-known vulnerabilities: opportunistic scanning and exploitation against unpatched, internet-exposed instances continuing long after initial disclosure, as unpatched self-hosted deployments remain discoverable years later.

Impact Assessment

A CVSS score of 9.8 at the critical tier reflects an attack that is network-exploitable, requires no privileges, and compromises confidentiality, integrity, and availability to the fullest extent for the data in scope.

What an attacker achieves:

• Confidentiality: Full read access to any file stored in the targeted user’s ownCloud account — documents, shared files, potentially sensitive business records — without ever authenticating.
• Integrity: The ability to overwrite (PUT) files in the victim’s storage, which could be used to plant malicious documents, tamper with shared files relied upon by other users, or corrupt data silently.
• Availability: The ability to delete (DELETE) any file the victim account can access, which can mean data loss across shared folders and synced content on every device connected to that account.
• Scale of exposure: Because exploitation only requires knowing a username — information that is often guessable (email-address-as-username conventions), enumerable, or already leaked in prior breaches — this bypass scales well for attackers performing bulk account targeting across an organization’s entire ownCloud user base.

Sector-specific risk: Self-hosted file-sharing platforms like ownCloud are frequently chosen specifically by organizations with heightened data-sovereignty or compliance requirements — healthcare, legal, government, and education sectors commonly run ownCloud to keep file storage in-house. For these organizations, an unauthenticated file read/write/delete bypass is especially damaging: the exact sensitive-data protections that motivated self-hosting in the first place are undermined by a flaw that requires nothing more than a username.

Affected Versions

The KEV record does not provide an explicit version range in the fields supplied. ownCloud’s own security advisory for this issue is the authoritative source for affected and fixed versions.

Organizations should consult ownCloud’s security advisory on the WebDAV API authentication bypass for the definitive list of affected version ranges and the corresponding patched release, since the provided KEV data does not enumerate specific build numbers.

Remediation Steps

CISA’s required action is to apply mitigations per vendor instructions, in compliance with BOD 26-04 and its Forensics Triage Requirements.

1. Apply the vendor patch referenced in ownCloud’s security advisory immediately — this is the only complete fix for the signing-key validation gap.

   # Example — update an ownCloud server instance (adjust for your deployment method)
   sudo -u www-data php occ upgrade
   sudo -u www-data php occ maintenance:mode --off

2. Ensure every account has a signing key provisioned as a defense-in-depth measure, since the root cause is tied to accounts lacking one. Check your ownCloud instance’s user management and signing-key configuration status for all active accounts.
3. Audit WebDAV access logs for any PROPFIND, GET, PUT, or DELETE requests against pre-signed URL paths that do not correlate with a legitimate signing-key-based session, particularly for accounts that may not have had a key configured prior to patching.
4. Rotate affected credentials and review file-level audit trails for any account suspected of being targeted, given that exploitation requires no password — a password rotation alone does not fully remediate; the patch must be applied.
5. Conduct forensic triage on any internet-facing ownCloud instance that was unpatched prior to 2026-08-27, per BOD 26-04 Forensics Triage Requirements, and discontinue exposure of the service if mitigation is not achievable in time.

Detection Guidance

Specific IDS/WAF signatures for this exact CVE have not been published in the data available; the following detection approaches are appropriate for this vulnerability class:

• WebDAV access logs: Review for requests to pre-signed URL / signed-WebDAV paths where the signature parameter does not match an expected format, or where requests succeed against usernames with no provisioned signing key — this requires application-level logging of signing-key lookups, which may need to be enabled.
• Anomalous file operations: Look for PUT/DELETE operations against user storage that originate from source IPs or user agents inconsistent with the account’s normal sync-client behavior (e.g., unfamiliar WebDAV clients, missing standard ownCloud desktop/mobile client user-agent strings).
• Username enumeration precursors: Since exploitation depends on knowing a valid username, a spike in failed login attempts or directory/user-enumeration requests prior to anomalous WebDAV activity against the same usernames can be a leading indicator.
• Bulk file access patterns: A sudden burst of file reads/writes/deletes across many different user accounts from the same source IP is consistent with mass exploitation attempts against this bypass.

Exact detection signatures should be sourced from ownCloud’s own security advisories or your IDS/WAF vendor’s rule feed once CVE-specific signatures are published, as the KEV data provided does not include IOC-level detail.

Timeline

References

• ownCloud Security Advisories
• ownCloud Security Advisory — WebDAV API Authentication Bypass Using Pre-Signed URLs
• CISA BOD 26-04: Prioritizing Security Updates Based on Risk
• CISA BOD 26-04 Implementation Guidance / Forensics Triage Requirements
• NVD — CVE-2023-49105