[HIGH PRIORITY] ownCloud WebDAV Authentication Bypass (CVE-2023-49105)

⚠ HIGH PRIORITY — CISA KEV (Aug 27, 2026). CVE-2023-49105 is an improper-authentication flaw in ownCloud Server. Attackers access, modify, or delete any file without authentication via WebDAV pre-signed URLs when the victim username is known and no signing key is configured.

Affected ownCloud

• ownCloud Server before 10.13.3
• Graph API /apps/graphapi/1.0/apps/files/{file-id} endpoint enabled
• Internet-exposed ownCloud on ports 443/80

Check version

sudo -u www-data php occ status
sudo -u www-data php occ config:system:get version
curl -sk https://cloud.example.com/status.php

Patching Method

1. Upgrade ownCloud Server to 10.13.3 or later.
2. Delete exposed graphapi app if not required: occ app:remove graphapi.
3. Rotate all user passwords and OAuth/app passwords post-upgrade.
4. Review ownCloud audit logs for unauthorized WebDAV file access.
5. Restrict ownCloud to VPN or internal network at firewall.
6. Verify no third-party signing keys were added by attacker.

sudo -u www-data php occ upgrade
sudo -u www-data php occ app:list | grep graphapi

Until patched

• Disable graphapi app immediately as emergency mitigation
• Block public WebDAV paths at reverse proxy
• Assume file exfiltration if internet-facing and unpatched

CVSS: Critical. Federal deadline: 30 Aug 2026.