Possibility to extend internal share permissions using the API – ownCloud

An Attacker can extend the permission of a received internal-share using the ocs-api. Check is currently only done in the UI. Affected Software ownCloud Server 10.2.1 CVE-2019-???? core/4ae39f7c70bb26e55d7396184da5c30dd75980a3 Action Taken Added better checks which prevent extending the permissio...

Bypass of application specific PIN

The ownCloud Android application does support setting a PIN that has to be provided before the application can be opened. An attacker may remove the PIN by clearing the application data via the Android system settings. By doing that the application information would be removed while the...

Improper access control in SVG preview generation - ownCloud

Improper access control in SVG preview generation may allow an authenticated attacker to gain access to other user’s images...

Subdomain Validation Bypass - ownCloud

Within the oauth2 app an attacker is able to pass in a specially crafted redirect-url which bypasses the validation code and thus allows the attacker to redirect callbacks to a TLD controlled by the attacker...

Server: Users can mount the local filesystem

Due to an insufficient permission check authenticated users are able to access preview pictures of others users. For more information please consult the official advisory. This advisory is licensed CC BY-SA 4.0...

Access to all file-versions of a user as soon as he has one share with the attacker – ownCloud

------- An authenticated attacker can access all versions of all files even unshared as soon as the owner of said files has at least one outgoing share with the attacker. To attacker needs to guess a file-id which is numeric and sequential. Affected ----- - owncloud/core = v10.0.9 - owncloud/core...

Server: Multiple XSS

Multiple stored and reflected XSS have been adressed. For more information please consult the official advisory. This advisory is licensed CC BY-SA 4.0...

URL manipulation when sharing files via email - ownCloud

Improper handling of URL in sharing notification may allow an authenticated attacker to send an email to another user containing a potentially malicious URL...

Security Notice: Impact of CVE-2026-33634 on ownCloud Build Infrastructure - ownCloud

No customer data was compromised. No source code was altered. The attack affected our build infrastructure only – specifically the systems that produce container images and client binaries. If you are using a build before March 19th, no action is needed If you are using ocis-rolling image conta...