EUVD-2026-111127Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach federated share endpoint unauthenticated
-
DeliveryAbuse endpoint to write arbitrary oc_share_external rows
-
ExploitPersist indefinitely, no cleanup
-
ExecutionTrigger three self-renewing DoS conditions
-
ImpactAvailability loss recurring every 24 hours
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource consumption limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the Nextcloud federated share endpoint (federation/OCM sharing) to be reachable and accepting external federated share requests from the attacker's source; the write primitive into oc_share_external is invoked through that endpoint. Per the CVSS vector (PR:N/UI:N) the action is unauthenticated with no user interaction, so an internet-exposed server with federated sharing available is directly at risk against default-style deployments. The limiting factors are: the endpoint/federated-sharing functionality must be enabled and network-accessible, the installed version must fall within Server 22.0.0 to ≤34.0.0, and impact is confined to availability (no data disclosure or modification). The injected rows persist with no automatic cleanup and the DoS self-renews on a 24-hour cycle, so recovery requires manual removal of the rows in addition to patching. |
| Impact | Severity is driven entirely by availability: the input CVSS 3.0 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) describes an unauthenticated, low-complexity, remote resource-exhaustion flaw (CWE-400) with no confidentiality or integrity impact. The vuln.today decision label is 'this_week' rather than act_now/emergency, which aligns with a high-impact but non-code-execution DoS. No EPSS score and no KEV status are provided in the input, so neither widespread automated exploitation nor active in-the-wild use can be asserted. The HackerOne report (reference 3679640) is a public PoC reference but is not verified as working exploit code. The signals are internally consistent - a genuinely remote, unauthenticated DoS primitive that persists indefinitely and self-renews every 24 hours - but the real-world priority is tempered by the fact that impact is limited to availability and no confirmed exploitation telemetry (KEV/EPSS) is supplied. Treat as a real, patch-this-week availability risk for internet-exposed Nextcloud instances, not a confidentiality/integrity emergency. |
| Exploit ScenarioDerived | An attacker sends crafted requests to a reachable Nextcloud federated share endpoint, with no authentication, to insert attacker-controlled rows into the oc_share_external table. Because the rows persist with no automatic cleanup and re-trigger the denial-of-service conditions on a 24-hour cycle, a single unauthenticated interaction produces a self-renewing availability outage until the rows are manually removed. A public PoC reference exists (HackerOne report 3679640); it is not verified as working exploit code. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 28, 2026
Unauthenticated requests against Nextcloud Server's federated share endpoint (Server 22.0.0 through 34.0.0 per EUVD) can be abused to insert arbitrary rows into the oc_share_external table, and because that table has no automatic cleanup the injected rows persist indefinitely. Three distinct denial-of-service conditions follow from this write primitive, all triggered from the same unauthenticated source and all re-firing on a 24-hour cycle for as long as the rows remain in the database. Severity is driven entirely by availability impact (CVSS 3.0 base 7.5, CWE-400, C:N/I:N/A:H); there is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, though exploitation code could not be ruled out from the HackerOne report referenced.
RemediationAI
No vendor-released fixed version is identified in the supplied references, so the fix state must be confirmed against Nextcloud's own advisories and the linked HackerOne report (https://hackerone.com/reports/3679640) and VulDB entry (https://vuldb.com/vuln/427432) before planning an upgrade of the affected 22.0.0-34.0.0 branches; given the vuln.today 'this_week' prioritization, treat that confirmation as the immediate action. Because the assessed exploitation condition is reachability of the federated share endpoint, the direct compensating control is to disable federated/server-to-server (OCM) sharing - both incoming and outgoing federation - on any instance that does not require it, with the trade-off that legitimate cross-instance shares stop working and existing federated shares may become unusable. Where federation must remain available, restrict the federated share endpoint at the reverse proxy or WAF to known partner OCM providers and rate-limit inbound share requests, accepting that this breaks ad-hoc federation with unknown servers and requires ongoing allow-list maintenance. Patching alone does not clear already-injected data: because there is no automatic cleanup, administrators must manually remove the offending rows from oc_share_external, otherwise the 24-hour denial-of-service cycle continues even after the code-level issue is addressed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Nextcloud's federation feature (server-to-server / OCM sharing) lets a server accept share offers from remote Nextcloud instances, and the metadata for each incoming offer is stored as a row in the oc_share_external database table. The federated share endpoint is designed to be reachable by remote peers, so the request path is network-facing and, per the assessed vector (PR:N/UI:N), requires no authentication or user interaction. The defect class is CWE-400 (Uncontrolled Resource Consumption): the endpoint permits a remote party to write arbitrary rows into oc_share_external without adequate validation or bounding, and the table has no expiry or garbage-collection mechanism, so attacker-supplied rows are durable. From that write primitive the report derives three separate denial-of-service conditions that recur every 24 hours while the rows remain. The available sources do not describe the precise request-level trigger, the individual DoS mechanisms, or the fields written beyond the target table, so those specifics should be confirmed against the HackerOne report (3679640) and the VulDB advisory (427432). Impact is bounded to availability - the assessed vector records no confidentiality or integrity effect.
Know when Server gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Unauthenticated remote abuse of a network endpoint with low complexity (AV:N/AC:L/PR:N/UI:N); impact is pure resource-exhaustion DoS, so C:N/I:N/A:H with unchanged scope.
Primary rating from Vendor (hackerone).
CVSS VectorVendor: hackerone
DescriptionCVE.org
Abusing the federated share endpoint, an attacker can write arbitrary rows into the oc_share_external database table. These rows persist indefinitely - there is no automatic cleanup mechanism. Three distinct denial-of-service conditions follow from this write primitive, all triggered from the same unauthenticated source and all self-renewing on a 24-hour cycle for as long as the injected rows remain in the database.
Executive ViewAI
CVE-2026-77167 is a high-severity unauthenticated denial-of-service vulnerability in Nextcloud Server (versions 22.0.0 through 34.0.0) that allows an attacker to inject persistent rows into the federated share table, causing recurring service disruptions every 24 hours without automatic cleanup. This impacts all organizations relying on Nextcloud for file sharing and collaboration, leading to potential productivity loss and operational disruption until manual intervention occurs. Leadership should prioritize remediation because the vulnerability is easy to exploit remotely and can repeatedly interrupt business-critical services.
Restrict unauthenticated access to the federated share endpoint via network controls (e.g., WAF rules or IP allowlists), monitor and manually clean anomalous entries in the oc_share_external table, and apply vendor-recommended interim mitigations if provided.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Traccar Traccar Server version 4.0 and earlier contains a CWE-94: Improper Control of Generation of Code ('Code Injectio
Account takeover in self-hosted Bitwarden Server before 2026.6.0 lets a low-privileged organization member steal any oth
Full user impersonation in the Laci Synchroni sync server (backend prior to 1.2.3) lets an attacker take over any accoun
Provider service users in Bitwarden Server Cloud can hijack arbitrary organizations via unauthorized API endpoint access
NoMachine Server is affected by Integer Overflow. Rated high severity (CVSS 8.8), this vulnerability is low attack compl
NoMachine Server is affected by Buffer Overflow. Rated high severity (CVSS 8.8), this vulnerability is low attack comple
Authentication bypass in Bitwarden Server versions prior to 2026.4.1 allows authenticated users with SCIM management pri
JetAudio jetCast Server 2.0 contains a stack-based buffer overflow vulnerability in the Log Directory configuration fiel
Credential-holding attackers can completely bypass TOTP two-factor authentication on Sync-in Server versions prior to 2.
A broken authentication vulnerability in 4D SAS 4D Server software v17, v18, v19 R7, and earlier allows attackers to sen
An information disclosure vulnerability in 4D SAS 4D Server Application v17, v18, v19 R7 and earlier allows attackers to
Privilege escalation in self-hosted Bitwarden Server before 2026.5.0 lets an authenticated organization member holding a
GitHub PoC
Exploit-DB