An authentication bypass in ownCloud's core. NVD scores it 9.8 (Critical, CVSS 3.1) and records it as analysed: an attacker can access, modify or delete any file without authentication if the victim's username is known and the victim has no signing key configured, because pre-signed URLs are accepted even when no signing key exists for the file's owner. The earliest affected version is 10.6.0.

CISA added the flaw to its Known Exploited Vulnerabilities Catalog on 27 August 2026 on evidence of active exploitation, which converts an already severe design flaw into a patching deadline. The control to check first is not the version string but the configuration: an ownCloud instance where every account has a signing key configured is not exposed in the way the advisory describes, so the remediation order is to patch to 10.13.1 or later and then confirm no file-sharing accounts are operating without a signing key.

• NVD record — CVE-2023-49105
• CISA KEV alert, 27 August 2026