A vulnerability in ownCloud known since late 2023 lets attackers access files without authentication. The trick lies in pre-signed URLs and missing signing keys. If you run ownCloud, you should check your installation right away.
Known since 2023, now reported as actively exploited
The vulnerability CVE-2023-49105 carries a CVSS score of 9.8 and an EPSS score of 43.21. It has been known and fixed since November 2023, but was only reported as actively exploited in late August 2026. CISA has since added the vulnerability to its Known Exploited Vulnerabilities catalog.
Authentication bypass via pre-signed URLs
ownCloud is an open-source platform for file sharing and synchronization that companies can run themselves as an alternative to commercial cloud storage. The vulnerability affects the platform's WebDAV API. Attackers can read, modify, or delete arbitrary files without authentication, provided they know the victim's username and no signing key is configured for that user, which, according to ownCloud, is the default setting. The cause is that pre-signed URLs get accepted even when no signing key is stored for the owner of the files. The vulnerability falls under category CWE-665, meaning improper initialization, and can be exploited over the network with low complexity, requiring no privileges and no user interaction.
Check old installations now
Affected are ownCloud Core versions 10.6.0 through 10.13.0. Starting with version 10.13.1, the vendor blocks the use of pre-signed URLs when no signing key is configured for the file owner. The high EPSS score and the KEV catalog listing show that the vulnerability continues to be used in attacks. You should check your ownCloud instances and update to at least version 10.13.1; since newer versions are now available, installing the current release is recommended. Also check whether signing keys are configured for your user accounts. The vendor has published an FAQ page with further information on the vulnerability.