Live › vulnerability › CVE-2026-77167
Go to dashboardAn unauthenticated attacker can abuse the federated share endpoint to insert arbitrary rows into the oc_share_external database table, and those rows never expire. The injected rows trigger three denial-of-service conditions that recur every 24 hours while the rows remain.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 17:32 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|
| nextcloud-server | vendor | >= 22.0.0 (all branches 22 to 34, before patched releases) | 34.0.2, 33.0.7, 32.0.13, 31.0.15, 30.0.18, 29.0.17, 28.0.15, 27.1.12, 26.0.14, 25.0.14, 24.0.13, 23.0.13, 22.2.11 |
34.0.2, 33.0.7 or 32.0.13 (older branches: 31.0.15, 30.0.18, 29.0.17, 28.0.15, 27.1.12, 26.0.14, 25.0.14, 24.0.13, 23.0.13, 22.2.11)34.0.2, 33.0.7, 32.0.13, 31.0.14.8, 30.0.17.12, 29.0.16.19, 28.0.14.20, 27.1.11.29Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Abusing the federated share endpoint, an attacker can write arbitrary rows into the oc_share_external database table. These rows persist indefinitely — there is no automatic cleanup mechanism. Three distinct denial-of-service conditions follow from this write primitive, all triggered from the same unauthenticated source and all self-renewing on a 24-hour cycle for as long as the injected rows remain in the database.
This page as .md · .json · in your agent: get_signal("CVE-2026-77167")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.