CVE-2023-49105: ownCloud Auth Bypass Lands on CISA KEV, Three Years Late

The vulnerability lives in how ownCloud's WebDAV API validates pre-signed URLs. ownCloud supports generating a URL that grants time-limited access to a file without requiring a login, a common convenience feature for sharing links. That mechanism is supposed to be backed by a per-user signing key. CVE-2023-49105 exists because the server accepted a pre-signed URL as valid even when the target account had no signing key configured at all, which was the default state for many accounts. The only information an attacker needs is a valid username. No password, no session token, no prior access is required. Once the pre-signed URL is accepted, the attacker inherits that user's file permissions: read, write, and delete, exactly as if they were logged in. NVD and the GitHub Security Advisory both score this CVSS 9.8 (Critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, reflecting a network-exploitable, low-complexity bug with no privileges or user interaction required and full impact on confidentiality, integrity, and availability.

The flaw affects ownCloud Server (owncloud/core) versions 10.6.0 through versions prior to 10.13.1, per the GitHub Security Advisory GHSA-585g-f852-v6p4, which tracks CWE-287 (Improper Authentication), matching the classification in our own threat data. ownCloud's own November 2023 advisory urged administrators to upgrade immediately and separately recommended disabling the previewpath and OCS Sharing pre-signed URL feature entirely as an interim step if an immediate upgrade was not possible. If you are running any ownCloud Server release from the 10.6.x through 10.12.x line, or an early 10.13.x build before 10.13.1, treat the instance as vulnerable until you have confirmed the installed version against ownCloud's changelog. This is a server-side WebDAV API issue, not a client-side or desktop-sync-client issue, so the fix has to be applied on the ownCloud Server deployment itself.

CISA's KEV addition on 2026-08-27 is itself the strongest confirmation available: KEV entries require evidence of exploitation in the wild, not just theoretical risk. Our own threat-intel record marks this CVE as exploited (exploited: true) as of the same date. Separately, public research from late 2023 documented internet-wide scanning for vulnerable ownCloud instances within roughly a week of the original disclosure, which is a useful reminder that a vulnerability being three years old does not mean the exposed population has gone to zero. Federal civilian agencies subject to CISA's Binding Operational Directive 22-01 are required to remediate KEV-listed vulnerabilities by CISA's stated deadline; check the catalog entry directly for the exact remediation date that applies to your organization.

Because this bug abuses a legitimate WebDAV feature rather than a malformed request or injected payload, detection has to focus on anomalous use of the pre-signed URL mechanism itself rather than a single malicious string in a log line. Pull ownCloud's own access and WebDAV logs, not just your reverse proxy or WAF logs, since the request itself is well-formed HTTP.

Confirm your exposure with version and configuration checks rather than relying on scanner output alone, since this bug is a logic flaw in authentication handling rather than something every generic vulnerability scanner has a dedicated signature for.

The durable fix is the vendor patch. Where an immediate upgrade is not possible, ownCloud's own November 2023 guidance and the general shape of this vulnerability support a short list of compensating controls, none of which are a substitute for patching.

CVE-2023-49105 fits a pattern practitioners have seen repeatedly with internet-facing file-transfer and file-sync platforms: a single authentication logic flaw turns a trusted collaboration tool into an unauthenticated data-access point for anyone who can guess or enumerate a username. The 2023 MOVEit Transfer SQL injection campaign showed how quickly mass exploitation follows once a file-transfer platform's authentication or input validation fails, and the more recent Langflow unauthenticated RCE disclosure shows the same KEV-driven urgency pattern: a pre-auth bug quietly ages until active exploitation forces immediate attention. Organizations that expose file-sharing platforms to the internet without segmenting them from the rest of the environment or without a zero-trust posture around who can reach the service in the first place are the ones repeatedly caught out by this category of bug; our zero-trust network architecture guide covers how to structure access controls so a single authentication bypass in one internet-facing service does not translate into unrestricted lateral movement.

The single most consequential limitation of this bug, for defenders trying to gauge real-world exposure, is the precondition baked into the vulnerability itself: exploitation requires that the target account has no signing-key configured. If your organization already enforces signing keys on every account, whether by policy, by a hardening baseline applied after the 2023 disclosure, or by a configuration management tool, your practical exposure may be much lower than the CVSS 9.8 score suggests on its own, even on an unpatched version. The inverse is also true: if your ownCloud deployment predates any signing-key enforcement effort, or accounts were bulk-provisioned without one, the theoretical worst case is close to the practical one. Do not assume either way. Check the actual per-account configuration rather than inferring it from the patch level alone. Second, CISA's KEV catalog entry confirms exploitation occurred but, consistent with KEV's standard practice, does not publish attacker TTPs, campaign attribution, or a victim count, so we cannot characterize who is behind the renewed activity or how targeted versus opportunistic it is. Re-check CISA's KEV catalog page directly for any updates to that entry, and treat this advisory as a starting point for your own investigation rather than a complete incident picture. Third, our own threat-intel record for this KEV addition batches CVE-2023-49105 together with two unrelated CVEs from the same CISA catalog update, an artifact of how CISA's batch additions get ingested upstream; we have deliberately excluded that unrelated data from this advisory, but if you are cross-referencing our internal record directly, do not attribute the kernel or Artifactory findings to ownCloud. Finally, the fixed-version claim here comes from a single primary source, the GitHub Security Advisory, cross-referenced against NVD's CVE record; we did not find a live, current copy of ownCloud's original 2023 blog advisory to independently confirm the exact patch version number, so verify 10.13.1 against your own vendor changelog before treating it as final.