CVE-2023-49105

Timeline

Detection, updates, and resolution for this record.

1. Nov 21, 2023 · Catalog

   Detected

   An issue was discovered in ownCloud owncloud/core before 10.13.1. An attacker can access, modify, or delete any file without authentication if the username of a victim is known, and the victim has no signing-key configured. This occurs because pre-signed URLs can be accepted even when no signing-key is configured for the owner of the files. The earliest affected version is 10.6.0.

2. Aug 27, 2026 · CISA KEV

   Known exploited

   Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating

3. Aug 28, 2026 · Catalog

   Updated

   An issue was discovered in ownCloud owncloud/core before 10.13.1. An attacker can access, modify, or delete any file without authentication if the username of a victim is known, and the victim has no signing-key configured. This occurs because pre-signed URLs can be accepted even when no signing-key is configured for the owner of the files. The earliest affected version is 10.6.0.

4. Aug 30, 2026 · CISA KEV

   Remediation due

   Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating

Affected

• cpe owncloud/owncloud serverversion unspecified
• vendor ownCloud ownCloudversion unspecified

Sources

• CISA KEVCVE-2023-49105

  ownCloud contains an improper authentication vulnerability that allows an attacker to access, modify, or delete any file without authentication if the username of a victim is known, and the victim has no signing-key configured.

  cisa.gov
• CVE.orgCVE-2023-49105

  Official CVE identifier

  cve.org
• FIRST EPSSCVE-2023-49105

  30-day exploitation probability 42.9%

  first.org
• NIST NVDCVE-2023-49105

  An issue was discovered in ownCloud owncloud/core before 10.13.1. An attacker can access, modify, or delete any file without authentication if the username of a victim is known, and the victim has no signing-key configured. This occurs because pre-signed URLs can be accepted even

  nvd.nist.gov

References

• Third Party Advisory · hunt.io
• CISA note · nvd.nist.gov
• CISA note · owncloud.com
• CISA note · owncloud.org
• US Government Resource · cisa.gov
• CISA note · cisa.gov
• CISA note · cisa.gov