ownCloud's Three-Year-Old Auth Bypass Is Finally in the Wild: CVE-2023-49105 Lands on KEV
A 2023 ownCloud flaw lets anyone who knows a username mint pre-signed URLs and touch any file. CISA just added it to KEV — your ownCloud has probably been quietly vulnerable for three years.
Critical severity, 4 of 4. Act now — exploited, or trivially exploitable on an exposed service.CVSS 9.8Exploited in the wildKEV due 30 AUG 2026CVE-2023-49105 +1
owncloudself-hostedwebdav