{"id":"CVE-2023-49105","title":"An issue was discovered in ownCloud owncloud/core before 10.13.1","summary":"An issue was discovered in ownCloud owncloud/core before 10.13.1. An attacker can access, modify, or delete any file without authentication if the username of a victim is known, and the victim has no signing-key configured. This occurs b…","severity":"critical","cvss":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-287","CWE-287"],"vendor":"owncloud","product":"owncloud_server","affected":["owncloud_server >= 10.6.0, < 10.13.1"],"patched":["owncloud_server 10.13.1"],"published":"2023-11-21","updated":"2026-08-27","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2023-49105","references":[{"url":"https://owncloud.com/security-advisories/webdav-api-authentication-bypass-using-pre-signed-urls/","label":"cve@mitre.org"},{"url":"https://owncloud.org/security","label":"cve@mitre.org"},{"url":"https://owncloud.com/security-advisories/webdav-api-authentication-bypass-using-pre-signed-urls/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://owncloud.org/security","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://hunt.io/blog/chinese-speaking-operator-philippine-nuclear-naval-contractor","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-49105","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"tags":["nvd","kev","in-the-wild","exploit-available"],"epss":0.43205,"epssPercentile":0.98705,"kev":true,"kevDateAdded":"2026-08-27","kevDueDate":"2026-08-30","kevRansomware":false,"exploited":true,"ingestedAt":"2026-08-27T21:08:14.141Z","exploits":{"github":1,"githubRepos":["https://github.com/ambionics/owncloud-exploits"],"checkedAt":"2026-09-21T15:25:59.944Z"},"exploitAvailable":true,"slug":"CVE-2023-49105","body":"## Overview\n\nAn issue was discovered in ownCloud owncloud/core before 10.13.1. An attacker can access, modify, or delete any file without authentication if the username of a victim is known, and the victim has no signing-key configured. This occurs because pre-signed URLs can be accepted even when no signing-key is configured for the owner of the files. The earliest affected version is 10.6.0.\n\n## Affected\n\n- `owncloud_server >= 10.6.0, < 10.13.1`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `owncloud_server 10.13.1`","depth":"hadal","depthScore":88,"depthScoreParts":{"impact":53.9,"likelihood":8.6,"exploitation":25,"ransomware":0},"changes":[{"seq":4668,"id":"CVE-2023-49105","ts":1788887197949,"field":"exploit_available","old":"false","new":"true"},{"seq":3551,"id":"CVE-2023-49105","ts":1788886314108,"field":"exploit_available","old":"true","new":"false"},{"seq":2405,"id":"CVE-2023-49105","ts":1788882983329,"field":"exploit_available","old":"false","new":"true"},{"seq":1434,"id":"CVE-2023-49105","ts":1788882396284,"field":"exploit_available","old":"true","new":"false"},{"seq":548,"id":"CVE-2023-49105","ts":1788881832620,"field":"exploit_available","old":"false","new":"true"},{"seq":205,"id":"CVE-2023-49105","ts":1787949931569,"field":"epss","old":"0.11074","new":"0.41192"}]}