Bug 2484166 (CVE-2026-45283)
| Summary: | CVE-2026-45283 nextcloud-server: Nextcloud Server: Unauthorized file modification and denial of service via improper WebDAV handling | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security DevOps Team <prodsec-dev> |
| Status: | NEW --- | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | Keywords: | Security |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in Nextcloud Server. An authenticated user could exploit this vulnerability to lock or unlock files belonging to other users by manipulating WebDAV (Web Distributed Authoring and Versioning) paths. This issue also led to the disclosure of lock tokens in error responses, potentially allowing attackers to remove locks set by legitimate users. The consequences include unauthorized file modification and a potential denial of service.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2484170, 2484172 | ||
| Bug Blocks: | |||
|
Description
OSIDB Bzimport
2026-06-02 21:06:41 UTC
|