CVE-2023-49105
Critical · 9.8 CISA KEVCVSS
9.8
EPSS
43.2%
Published
Nov 21, 2023
CISA due date
Aug 30, 2026
The record
An issue was discovered in ownCloud owncloud/core before 10.13.1. An attacker can access, modify, or delete any file without authentication if the username of a victim is known, and the victim has no signing-key configured. This occurs because pre-signed URLs can be accepted even when no signing-key is configured for the owner of the files. The earliest affected version is 10.6.0.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-63398 Coop is an open source review and moderation tool from ROOST. CWE-287
- CVE-2026-116239 In server mode pgAdmin 4 keeps an account per authentication source, so the same username… CWE-287
- CVE-2026-62264 PDF Reader MCP is a Model Context Protocol server for reading PDF documents. CWE-287
- CVE-2026-61739 SOCFortress CoPilot focuses on providing a single pane of glass for all your security… CWE-287
- CVE-2026-110799 Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or… CWE-287
- CVE-2026-119572 Traefik from 3.7.0-ea.1 before 3.7.15 contains an authentication bypass vulnerability in… CWE-287
- CVE-2026-118194 The Page and Post Restriction plugin for WordPress is vulnerable to Authentication Bypass… CWE-287
- CVE-2026-114443 The Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plugin before… CWE-287