Read the docs
TI-2026-86060 Aliases CVE-2026-84473GHSA-394x-x23m-q4f9

Missing brute-force protection in ownCloud WebDAV endpoint

Priority LOW 23Published · Updated

Key facts

Attack vector
—
Privileges required
—
User interaction
—
Attack complexity
—
Impact type
—
Confidentiality · integrity · availability
—
Fix status
Fixed

No CVSS vector from any source. Fix status from CNA.

Summary

Kiteworks ownCloud server from 10.16.3 before 11.1.0 is affected. The WebDAV endpoint at remote.php/webdav/ lacks brute-force protection. An unauthenticated remote attacker can make unlimited online password guessing attempts against WebDAV accounts using repeated HTTP Basic Authentication requests.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

Authentication Bypass / Missing Brute-Force Protection in remote.php/webdav/ in ownCloud ownCloud server 10.16.3 allows an unauthenticated remote attacker to perform unlimited online password guessing against WebDAV accounts via repeated HTTP Basic Authentication requests to the WebDAV endpoint.

Why it matters now

EPSS 0.00339 27th percentileScored 2026-11-07
Fix Fixed ownCloud (Kiteworks): 11.1.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
AccellionownCloud10.16.3 to before 11.1.011.1.0Patch availableCNA
  • ownCloud VendorAccellion Affected 10.16.3 to before 11.1.0 Fixed in 11.1.0 Patch available CNA

Remediation

Update Kiteworks ownCloud to version 11.1.0, which is the fixed version.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA ownCloud (Kiteworks) Fixed in 11.1.0

Timeline

  1. 2026-11-06 Threatist record created from CVE-2026-84473
  2. 2026-11-06 Alias added: GHSA-394x-x23m-q4f9

References

Other 1

  • TI-2021-08672 Accellion FTA 9_12_370 and earlier is affected by OS command execution via a crafted POST… KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-08671 Accellion FTA 9_12_411 and earlier is affected by SSRF via a crafted POST request to… KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-08669 Accellion FTA 9_12_370 and earlier is affected by SQL injection via a crafted Host header… KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-08670 Accellion FTA 9_12_411 and earlier is affected by OS command execution via a local web… KEVCVSS 3.1HIGH 7.8
  • TI-2015-02522 Accellion File Transfer Appliance before FTA_9_11_210 allows remote attackers to execute… CVSS 3.1CRITICAL 9.8
  • TI-2021-11694 Accellion Kiteworks before 7.4.0 allows an authenticated user to perform SQL Injection via LDAPGroup Search. CVSS 3.1HIGH 8.8
See all 127 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences