Summary
| Parameter | Value |
|---|---|
| CVE ID | CVE-2023-49105 |
| Alert Source | CISA KEV - Active Exploitation |
| CVE Year | 2023 |
| Publication Date | 2026-08-27 |
| Vendor | ownCloud |
| Product | ownCloud Server (owncloud/core) |
| CVSS Score | 9.8 (Critical) |
| EPSS Score | 11.1% (percentile: 96%) |
| CISA KEV | Yes - confirmed active exploitation |
| Ransomware | Not confirmed |
| Due Date | 2026-08-30 |
Vulnerability Description
Source: CISA KEV / NVD
ownCloud Server before 10.13.1 contains an authentication bypass. An attacker who knows a victim’s username can read, modify or delete any of that user’s files — with no login and no credentials.
The cause is that pre-signed URLs are accepted even when the user has no signing key configured. In that state the signature is verified against nothing, so access control rests entirely on knowing the username. Corporate usernames are usually predictable (first.last), which makes that condition trivial to satisfy.
An EPSS score of 11% at the 96th percentile puts this among the most frequently attacked vulnerabilities — one of the rare cases where that metric actually says something.
Required Actions
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 “Prioritizing Security Updates Based on Risk” guidance and CISA’s “Forensics Triage Requirements”. Follow applicable BOD 26-04 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset’s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
In practice: upgrade to ownCloud Server 10.13.1 or later. If an immediate upgrade is not possible, identify which users have no signing key configured — those are the exposed accounts.
CISA’s deadline for US federal agencies: 2026-08-30.
Who Is Affected?
The vulnerability affects ownCloud Server (owncloud/core) installations older than 10.13.1.
ownCloud is typically chosen where data cannot go to a public cloud — local government, healthcare, universities and companies with data-residency requirements. These are self-hosted installations, often without a regular patching cycle, so pre-10.13.1 versions are still encountered in the field.
Sources
Need help securing your systems? nFlo team offers vulnerability management and 24/7 SOC services. Contact us.
