ownCloud's Three-Year-Old Auth Bypass Is Finally in the Wild: CVE-2023-49105 Lands on KEV

The short version//

CISA added CVE-2023-49105 to the KEV catalog on 2026-08-27, with a remediation deadline of 2026-08-30 (Sunday). Here's the part that stings: this isn't a new hole. ownCloud disclosed it on 2023-11-21. That's a three-year-old CVSS 9.8 authentication bypass that's only now getting the in-the-wild treatment. If you run ownCloud and you didn't patch it in late 2023, you have been quietly exploitable for years — and now the scanners have found you.

Pre-signed URLs, in one breath//

A pre-signed URL is a link a server signs to grant temporary, scoped access to a resource — so the holder can download or modify a file without re-authenticating every time. The signature is what proves the server meant to issue it.

The bug: ownCloud accepts pre-signed URLs even when no signing key is configured. And no signing key is the default. So in a stock install, there's no secret to forge — the "signature" is effectively unchecked. An attacker who knows a victim's username can mint their own pre-signed URLs for arbitrary file operations.

That's CWE-665, improper initialization — a security control that's supposed to exist is sitting at its factory default, which happens to be "off."

What that actually gets you//

• Read, modify, or delete any file belonging to the target user — no password, no session.
• GreyNoise's researchers (including Ron Bowes, who shipped a PoC) demonstrated the bypass chains to remote code execution — replace a file that something else executes, and you're in.
• This one affects all installations, not just Docker-based ones. (Its sibling, the CVSS 10 CVE-2023-49103, was the Docker-only one that ate all the headlines in 2023. This is the quieter, broader one.)

The impact set — data theft, ransomware deployment, RCE — is the standard "they got write access to your files" worst case.

Why this is a great cautionary tale//

The root cause is the exact class of self-hosted misconfig the audience lives with: a security feature that's disabled until you turn it on, in a default you never audited. No phishing, no leaked password, no CVE-2026 in the changelog — just a 2023 advisory that got filed under "someday."

KEV membership changes that. Being on KEV is a factual statement: someone is exploiting it in the wild right now. (For how to read KEV and EPSS together, see our vCenter post.)

What you should do//

1. Upgrade to ownCloud 10.13.3 or later — the vendor's fix denies pre-signed URLs when no signing key is configured for the file owner, which kills the no-prior-config attack path.
2. Set a signing key regardless of version, so the signature check has something to check against.
3. Check your exposure — if ownCloud is reachable from the internet, it's been a known target for three years. Look for modified or deleted files and processes you don't recognize.
4. Assume compromise if exposed — a flaw this old and this simple has probably already been used on you.