CVE-2023-49105 · Critical · CISA KEV

ownCloud Improper Authentication: Critical Risk of Unauthorized File Access

Threat Engine Auto-Feed · data current as of 2026-08-27

CVE-2023-49105, an improper authentication vulnerability in ownCloud, allows unauthenticated attackers to access, modify, or delete files if a victim's username is known and no signing key is configured. This vulnerability is actively exploited in the wild, as confirmed by its inclusion in the CISA KEV catalog, indicating a critical exploitation pressure.

  • CVSS:
  • EPSS percentile: 0.95592
  • Exploitation pressure: 82/100 (Critical)

Exploitation reality: listed in CISA KEV (exploited in the wild) · EPSS 96th percentile. Threat × Vulnerability from public signals — impact depends on your environment.

Weakness —

This vulnerability stems from a flaw in how ownCloud verifies user identities. It fails to properly authenticate requests, allowing an attacker to bypass security checks and gain unauthorized access to files if they know a valid username and the target user has not configured a specific security key.

Who's at risk

Exposure: unknown · Auth: unknown · unknown

Enterprise profiles most at risk

  • Organizations using ownCloud for file sharing and collaboration
  • Enterprises with a large number of ownCloud users
  • Organizations in financial services or technology sectors, given assessed adversary targeting

Misconfigurations that escalate it

  • ownCloud instances where users have not configured a signing-key
  • Environments where user enumeration is possible, making it easier for attackers to guess usernames

High-impact scenarios

  • Unauthorized access, modification, or deletion of sensitive files, leading to data breaches or integrity compromises
  • Disruption of critical business operations due to data manipulation or destruction
  • Espionage or financial theft, particularly for organizations targeted by sophisticated threat actors

Likely adversaries

  • FIN7 — Financial services (Assessed)
  • LockBit affiliates — Financial services (Assessed)
  • APT38 (Lazarus) — Financial services (Assessed)
  • APT29 (Cozy Bear) — Technology (Assessed)
  • Scattered Spider — Technology (Assessed)

What to do (defensive)

Detect

  • Monitor ownCloud access logs for unusual activity, especially unauthenticated attempts to access, modify, or delete files.
  • Implement robust logging and alerting for failed authentication attempts and suspicious file operations.

Contain

  • Isolate affected ownCloud instances from the network if compromise is suspected.
  • Force password resets for all ownCloud users, especially those without a configured signing key.

Patch

  • Apply the latest security updates and patches provided by ownCloud to address CVE-2023-49105.
  • Ensure all ownCloud users configure a signing-key as a security best practice.

Frontier verdict — Critical

This is a critical vulnerability due to active exploitation in the wild and high EPSS percentile, requiring immediate patching and configuration review.

For detection-engineering and awareness only · point-in-time · not security advice · sourced from NVD, FIRST EPSS, CISA KEV. Adversary mappings are assessments unless cited.