Files Lock
Monthly
Cross-user lock manipulation in the Nextcloud Files Lock (files_lock) app allows any authenticated user to lock or unlock files they do not own by supplying the absolute WebDAV path of another user's file, because the DAV plugin resolves the request URI without confirming that the path belongs to the session user. An attacker who can enumerate or guess a victim's path can block editor saves and PUT/MOVE/DELETE writes, and can also have the application hand back the victim's lock token, which enables removal of token-based client locks. Rated 6.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) in the authoritative assessment, it requires a valid account and an enabled files_lock app on a multi-user instance; impact is limited to denial-of-write and lock-token disclosure with no file content read/write or code execution, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Cross-user lock manipulation in the Nextcloud Files Lock (files_lock) app allows any authenticated user to lock or unlock files they do not own by supplying the absolute WebDAV path of another user's file, because the DAV plugin resolves the request URI without confirming that the path belongs to the session user. An attacker who can enumerate or guess a victim's path can block editor saves and PUT/MOVE/DELETE writes, and can also have the application hand back the victim's lock token, which enables removal of token-based client locks. Rated 6.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) in the authoritative assessment, it requires a valid account and an enabled files_lock app on a multi-user instance; impact is limited to denial-of-write and lock-token disclosure with no file content read/write or code execution, and no public exploit code or confirmed active exploitation was identified at time of analysis.