CVE-2023-49105: ownCloud WebDAV Pre-Signed URL Authentication Bypass (KEV)

CVE-2023-49105 is an authentication bypass in ownCloud's WebDAV API that lets an attacker access, modify or delete any file without authentication as long as they know the victim's username and that victim has no signing-key configured — the product's default — and it remains on the live CISA KEV catalog as of 2026-10-27 with active reporting of use against nuclear and naval-contractor targets.

CVE-2023-49105 is an Improper Authentication (CWE-287) flaw in owncloud/core before 10.13.1. NVD's Analyzed description states: "An attacker can access, modify, or delete any file without authentication if the username of a victim is known, and the victim has no signing-key configured. This occurs because pre-signed URLs can be accepted even when no signing-key exists for the owner of the files" (NVD).

NVD published its own independent Primary CVSS v3.1 score of 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which matches the MITRE CNA's Secondary submission exactly — network-reachable, low attack complexity, no privileges or user interaction required, with high impact to confidentiality, integrity and availability (NVD).

ownCloud's own security advisory (published 2023-11-21) describes the same root cause in the vendor's own words: "It is possible to access, modify or delete any file without authentication if the username of the victim is known and the victim has no signing-key configured (which is the default)." The advisory rates it High severity with a CVSS v3 base score of 9.8 and the identical vector string, lists affected versions as ownCloud core 10.6.0 through 10.13.0, and states the fix denies pre-signed URL usage whenever no signing-key exists for the file owner — shipped in 10.13.1 (ownCloud security advisory).

CISA added CVE-2023-49105 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-08-27, nearly three years after initial disclosure, with a required-action due date of 2026-08-30 and forensic-triage required under BOD 26-04; the catalog does not record known ransomware campaign use. A third-party report cited directly by CISA's KEV notes links this CVE to intrusion activity against a "Philippine nuclear and naval contractor" attributed to a Chinese-speaking operator (CISA KEV).

As of 2026-10-27, FIRST scores the probability of exploitation at 0.4319 (98.718th percentile) — unusually high for a multi-year-old CVE, consistent with its recent confirmed re-exploitation (FIRST EPSS).

Any ownCloud core deployment still on 10.6.0-10.13.0 should be upgraded to 10.13.1 or later immediately, and administrators should check whether any user accounts are missing a signing-key, since those accounts remain exploitable by default.

• Authentication bypass in ownCloud's WebDAV API allows access, modification or deletion of any file without authentication if the victim's username is known and no signing-key is configured for that user (the default state). — NVD
• CVSS v3.1 base score is 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, published as NVD's own Primary score matching the CNA submission. — NVD
• Affected: ownCloud core 10.6.0 through 10.13.0, fixed in 10.13.1 by denying pre-signed URL usage when no signing-key exists for the file owner. — ownCloud security advisory
• Added to the CISA Known Exploited Vulnerabilities catalog on 2026-08-27, required-action due date 2026-08-30; third-party reporting cited by CISA links the CVE to intrusion activity against a Philippine nuclear and naval contractor. — CISA KEV
• EPSS score is 0.4319 (98.718th percentile) as of 2026-10-27. — FIRST EPSS