CISA Adds ownCloud CVE-2023-49105 to Actively Exploited Vulnerabilities
The U.S. cybersecurity agency CISA added the CVE-2023-49105 vulnerability in ownCloud Server to its Known Exploited Vulnerabilities catalog. Unpatched instances may expose users’ files to unauthorized reading, modification, or deletion.
The U.S. cybersecurity agency CISA added ownCloud CVE-2023-49105 to the Known Exploited Vulnerabilities (KEV) catalog, which lists flaws it has observed being exploited in the wild. This is an older WebDAV API vulnerability in ownCloud Server, but the new listing is a clear signal for administrators to prioritize finding and updating unpatched systems.
The flaw may allow an unauthenticated attacker to access another user’s files and potentially modify or delete them. The attacker must know the victim’s username, and no signing-key must be configured. According to ownCloud, the signing-key was not configured by default.
What ownCloud CVE-2023-49105 Enables
The vulnerability affects authentication in the WebDAV API when pre-signed URLs are used. In the affected configuration, an attacker may bypass identity verification if they know the target’s username. This could result in unauthorized reading, modification, or deletion of users’ files.
ownCloud reports that the product core is affected in versions 10.6.0 through 10.13.0. The risk therefore primarily concerns internet-accessible instances in this range that have not been patched and do not have a signing-key configured. In its KEV entry, CISA explicitly assesses the flaw as exploited, so this is not merely a theoretically published security issue.
A Fix Is Available
The vendor recommends updating ownCloud to version 10.13.3. Supported customers may also deploy a specific patch provided through ownCloud support. Administrators should first verify the deployed core version, whether the service is accessible from the internet, and the signing-key configuration status, then apply the recommended fix without unnecessary delay.
- Identify ownCloud Server installations with core versions 10.6.0 through 10.13.0.
- Prioritize checking instances accessible from the internet.
- Update to ownCloud 10.13.3 or use the patch intended for support customers.
- Check whether a signing-key is configured, but do not treat this as a substitute for fixing the vulnerability itself.
Why the KEV Listing Matters
CISA’s KEV catalog serves as an authoritative overview of vulnerabilities with confirmed exploitation. For ownCloud CVE-2023-49105, the addition therefore increases the urgency of remediation: the potential impact concerns not only service availability, but also the confidentiality and integrity of stored data.
However, the information provided does not identify a specific current campaign, the attacker’s identity, the number of affected instances, or the extent of any potential damage. It is also not confirmed whether the KEV listing is related to a new wave of attacks or to historical incidents verified at a later date.
Further developments will depend on whether CISA, ownCloud, national CERT teams, or affected organizations publish technical details about exploitation, recommendations for detecting compromise, or confirmed incidents.
Sources
- CISA Known Exploited Vulnerabilities Catalog – Confirms the addition of CVE-2023-49105 to KEV and CISA’s assessment that the vulnerability was exploited.
- ownCloud – WebDAV Api Authentication Bypass using Pre-Signed URLs – Confirms the flaw’s technical conditions, the affected core versions 10.6.0 through 10.13.0, and the remediation approach.
- ownCloud – Immediate Action Required: Critical Security Updates for ownCloud – Confirms the recommendation to update to ownCloud 10.13.3 or use the patch available through support.
Verified and updated: 08/27/2026 19:53
