CVE-2026-82980

Any authenticated user can lock or unlock files they do not own by targeting absolute WebDAV paths of other users. The DAV plugin resolves files from the absolute request URI without verifying that the path segment matches the authenticated session user. This enables: Cross-user manual locks :...

Nextcloud: Cross-User Lock/Unlock via Absolute DAV Path

A vulnerability was discovered in the fileslock app for Nextcloud. The vulnerability allowed any authenticated user to lock or unlock files they did not own by targeting absolute WebDAV paths of other users. This was possible because the DAV plugin resolved files from the absolute request URI...