🎯 New Report #3301553: Cross-User Lock/Unlock via Absolute DAV Path
🔺Severity: Medium
👽 Reporter: 0x0doteth
⭐️ Reputation: 1507
🛠 State: resolved
💼 Team: Nextcloud
💵 Bounty: null
🕐 Submitted: 2025-08-16
⏰ Disclosed: 2026-09-17 13:09:01
📝 Summary: A vulnerability was discovered in the files lock app for Nextcloud. The vulnerability allowed any authenticated user to lock or unlock files they did not own by targeting absolute WebDAV paths of other users. This was possible because the DAV plugin resolved files from the absolute request URI without verifying that the user ID path segment matched the authenticated session user. This enabled cross-user manual locks and lock token disclosure, which allowed unauthorized callers to remove token-based locks of other users.
📂 Report JSON File: 3301553
@hackeronereports