ownCloud core before 10.13.1 accepts pre-signed WebDAV URLs even when the file owner has no signing-key configured (the default). If the victim username is known, an unauthenticated attacker can access, modify, or delete any of that user's files. ownCloud rates CVSS 9.8. Fixed in 10.13.1 by denying pre-signed URLs when no signing-key is set. Patch, then review access logs for unexpected WebDAV activity.

UPDATE (25 Oct 2026): CISA added CVE-2023-49105 to its Known Exploited Vulnerabilities catalog on 27 August 2026, with a 30 August due date for US federal agencies, which means CISA has evidence it is being exploited. (source: CISA KEV catalog)