---
id: CVE-2026-82980
title: >-
  Any authenticated user can lock or unlock files they do not own by targeting
  absolute WebDAV paths of other users
summary: >-
  Any authenticated user can lock or unlock files they do not own by targeting
  absolute WebDAV paths of other users. The DAV plugin resolves files from the
  absolute request URI without verifying that the path segment matches the
  authentica…
severity: medium
cvss: 6.3
cvssVector: 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L'
cwe:
  - CWE-287
vendor: Nextcloud
product: Files Lock
affected:
  - files_lock >= 31.0.0 <= 33.0.0
published: '2026-09-18'
updated: '2026-09-18'
sourceUpdated: '2026-09-18T20:17:25.647'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-82980'
references:
  - url: 'https://hackerone.com/reports/3301553'
    label: support@hackerone.com
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-18T19:42:46.238881Z'
epss: 0.003
epssPercentile: 0.20129
ingestedAt: '2026-09-18T01:33:24.269Z'
---

## Overview

Any authenticated user can lock or unlock files they do not own by targeting absolute WebDAV paths of other users. The DAV plugin resolves files from the absolute request URI without verifying that the path segment matches the authenticated session user. This enables:

Cross-user manual locks : attacker locks a victim's files, blocking writes (PUT/MOVE/DELETE, editor saves).
Lock-token disclosure: the app returns the lock token to unauthorized callers, enabling them to remove token-based locks (client locks) of other users.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.