CVE-2023-49105

An issue was discovered in ownCloud owncloud/core before 10.13.1. An attacker can access, modify, or delete any file without authentication if the username of a victim is known, and the victim has no signing-key configured. This occurs because pre-signed URLs can be accepted even when no signing-key is configured for the owner of the files. The earliest affected version is 10.6.0.

• CWE-287

• https://owncloud.com/security-advisories/webdav-api-authentication-bypass-using-pre-signed-urls/Vendor Advisory
• https://owncloud.org/securityProduct
• https://owncloud.com/security-advisories/webdav-api-authentication-bypass-using-pre-signed-urls/Vendor Advisory
• https://owncloud.org/securityProduct

Published

Nov 21, 2023

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-4910A flaw was found In 3Scale Admin Portal. If a user logs out …5.5
• CVE-2023-49100Trusted Firmware-A (TF-A) before 2.10 has a potential read o…4.4
• CVE-2023-49101WebAdmin in Axigen 10.3.x before 10.3.3.61, 10.4.x before 10…6.1
• CVE-2023-49102NZBGet 21.1 allows authenticated remote code execution becau…8.8
• CVE-2023-49103An issue was discovered in ownCloud owncloud/graphapi 0.2.x …7.5
• CVE-2023-49104An issue was discovered in ownCloud owncloud/oauth2 before 0…6.1
• CVE-2023-49106Missing Password Field Masking vulnerability in Hitachi Devi…7.5
• CVE-2023-49107Generation of Error Message Containing Sensitive Information…7.5
• CVE-2023-49108Path traversal vulnerability exists in RakRak Document Plus …8.8
• CVE-2023-49109Exposure of Remote Code Execution in Apache Dolphinscheduler…9.8
• CVE-2023-4911A buffer overflow was discovered in the GNU C Library's dyna…7.8
• CVE-2023-49110When the Kiuwan Local Analyzer uploads the scan results to t…7.2