Summary
generated automatically from NVD dataownCloud owncloud/core before 10.13.1 (earliest affected version 10.6.0) has an authentication flaw (CWE-287) in how it handles pre-signed URLs, which can be accepted even when the file owner has no signing-key configured. An unauthenticated attacker who knows a victim's username can access, modify, or delete any of that user's files. It is rated CVSS 9.8 (CRITICAL) and is listed in the CISA KEV catalog, which indicates active exploitation.
NVD description
An issue was discovered in ownCloud owncloud/core before 10.13.1. An attacker can access, modify, or delete any file without authentication if the username of a victim is known, and the victim has no signing-key configured. This occurs because pre-signed URLs can be accepted even when no signing-key is configured for the owner of the files. The earliest affected version is 10.6.0.
⚠️ Actively exploited — CISA KEV
This CVE was added to CISA's Known Exploited Vulnerabilities catalog on 2026-08-27. It is confirmed exploited in the wild and must be patched as a priority.
Remediation deadline (US federal agencies): 2026-08-30
EPSS · FIRST.org
42.9%probability of exploitation in the next 30 days
Higher than 98% of scored CVEs
EPSS (Exploit Prediction Scoring System) estimates, from observed exploitation activity, how likely a CVE is to be exploited in the next 30 days. It complements CVSS, which measures severity, not likelihood. Score of 2026-10-18, recomputed daily by FIRST.org.
CVSS v3.1 Score
Information
- Published
- 21 nov. 2023
- Updated
- 28 août 2026
- Status
- Analyzed
- Source
- cve@mitre.org
Affected products
Weaknesses (CWE)
References (6)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-49105US Government Resource
Similar CVEs
Other vulnerabilities of type CWE-287
Monitor your products
Get automatic alerts for every new CVE affecting your equipment.