CVE-2023-49105: ownCloud Server WebDAV authentication bypass via pre-signed URLs

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityUnauthenticated network-reachable access allowing full read, write, and delete of user files, combined with a critical CVSS of 9.8, KEV listing, and high EPSS probability, makes this an urgent patch.

What it is

ownCloud core before 10.13.1 accepts pre-signed URLs even when the file owner has no signing-key configured, so the signature check is effectively skipped. An attacker who knows a victim's username can reach the WebDAV API and access, modify, or delete that victim's files without authenticating. The flaw affects versions from 10.6.0 onward and carries a critical CVSS of 9.8.

Impact

An unauthenticated attacker gains full read, write, and delete control over any file belonging to a known user, enabling data theft, tampering, or destructive deletion. Because no credentials are needed, the barrier is only knowledge of a valid username.

Attack surface

Reached over the network through the WebDAV API using crafted pre-signed URLs; no authentication and no user interaction are required per the CVSS vector (AV:N/AC:L/PR:N/UI:N). The only precondition stated is that the victim's username is known and the victim has no signing-key configured.

Exploitation

CVE-2023-49105 is listed in CISA's KEV catalog with a 2026-08-30 remediation due date, and EPSS gives a 30-day exploitation probability of about 43% (98.7th percentile). CISA does not flag known ransomware campaign use, and no ransomware groups are documented using it.

What to do

• Upgrade ownCloud core to 10.13.1 or later; this is the vendor fix for the pre-signed URL authentication bypass.
• If immediate patching is not possible, restrict or disable external access to the WebDAV API and follow the vendor security advisory's interim guidance.
• Ensure signing keys are configured for all accounts so pre-signed URLs are validated, and audit accounts lacking a signing key.
• Treat internet-exposed ownCloud instances as high risk and apply CISA BOD 26-04 prioritization, discontinuing use if mitigations are unavailable.
• Rotate credentials and review file integrity for accounts whose usernames may have been exposed.

Detection

• Review WebDAV access logs for requests carrying pre-signed URL parameters from unauthenticated or unexpected sources.
• Alert on file read, modify, or delete operations against accounts that have no signing-key configured.
• Monitor for anomalous bulk file access or deletion patterns across multiple user accounts from a single source.
• Correlate ownCloud authentication logs with WebDAV activity to find file operations lacking a matching authenticated session.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.