{"id":"CVE-2026-77167","kind":"vulnerability","aliases":["CVE-2026-77167"],"related":[],"title":"Nextcloud federated share endpoint lets attackers write rows and cause denial of service","description":"Abusing the federated share endpoint, an attacker can write arbitrary rows into the oc_share_external database table. These rows persist indefinitely — there is no automatic cleanup mechanism. Three distinct denial-of-service conditions follow from this write primitive, all triggered from the same unauthenticated source and all self-renewing on a 24-hour cycle for as long as the injected rows remain in the database.","summary":"An unauthenticated attacker can abuse the federated share endpoint to insert arbitrary rows into the oc_share_external database table, and those rows never expire. The injected rows trigger three denial-of-service conditions that recur every 24 hours while the rows remain.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"nextcloud-server","fixed":["34.0.2","33.0.7","32.0.13","31.0.15","30.0.18","29.0.17","28.0.15","27.1.12","26.0.14","25.0.14","24.0.13","23.0.13","22.2.11"],"affected":">= 22.0.0 (all branches 22 to 34, before patched releases)","ecosystem":"vendor"}],"ecosystems":[],"tags":["denial-of-service","federated-sharing","nextcloud","other","self-hosted"],"not_affected_if":["federated-sharing-disabled"],"how_to_check":"Check your Nextcloud version (Admin > Overview, or occ status) against the patched list. Look for unexpected rows in the oc_share_external table and check whether federated share receiving is enabled.","fix":"Upgrade Nextcloud Server to 34.0.2, 33.0.7 or 32.0.13 (older branches: 31.0.15, 30.0.18, 29.0.17, 28.0.15, 27.1.12, 26.0.14, 25.0.14, 24.0.13, 23.0.13, 22.2.11). Enterprise: 34.0.2, 33.0.7, 32.0.13, 31.0.14.8, 30.0.17.12, 29.0.16.19, 28.0.14.20, 27.1.11.29. Workaround: disable receiving federated sharing.","status":"open","published_at":"2026-10-27T17:17:02+00:00","first_seen_at":"2026-10-27T17:32:46+00:00","triaged_at":"2026-10-27T17:34:32+00:00","updated_at":"2026-10-27T17:38:26+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-10-27T17:34:32Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Nextcloud federated share endpoint lets attackers write rows and cause denial of service","impact":"medium","summary":"An unauthenticated attacker can abuse the federated share endpoint to insert arbitrary rows into the oc_share_external database table, and those rows never expire. The injected rows trigger three denial-of-service conditions that recur every 24 hours while the rows remain.","category":"other","nicknames":[],"who_cares":["nextcloud","self-hosted"],"confidence":0.5,"needs_auth":"no","worst_case":"Unauthenticated attacker causes recurring denial of service via database rows","analyst_note":"Sources list only NVD; the affected product versions and the fixed release are not stated. Check the NVD entry and the Nextcloud security advisories for the affected range and patch version.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00052,"input_tokens":3347,"output_tokens":370,"severity_before":"high"},"analyst_status":"done","analyst_note":"Sources list only NVD; the affected product versions and the fixed release are not stated. Check the NVD entry and the Nextcloud security advisories for the affected range and patch version.","search":"'-2026':15A,18A '-77167':16A,19A '24':73B,133C 'abus':39B,79C 'arbitrari':46B,88C 'attack':6A,37B,85C 'automat':104C 'caus':10A 'cleanup':105C 'condit':69B,113C 'cve':14A,17A 'cycl':135C 'databas':53B,95C,146C 'denial':11A,24B,66B,110C 'denial-of-servic':23B,65B,109C 'distinct':108C 'endpoint':4A,43B,83C 'everi':72B 'expir':59B 'extern':52B,94C 'feder':2A,28B,41B,81C 'federated-shar':27B 'follow':114C 'host':34B 'hour':74B,134C 'indefinit':100C 'inject':61B,141C 'insert':45B 'let':5A 'long':138C 'mechan':106C 'never':58B 'nextcloud':1A,21A,30B 'nextcloud-server':20A 'oc':50B,92C 'persist':99C 'primit':118C 'recur':71B 'remain':78B,143C 'renew':130C 'row':8A,47B,57B,62B,77B,89C,98C,142C 'self':33B,129C 'self-host':32B 'self-renew':128C 'server':22A 'servic':13A,26B,68B,112C 'share':3A,29B,42B,51B,82C,93C 'sourc':125C 'tabl':54B,96C 'three':64B,107C 'trigger':63B,120C 'unauthent':36B,124C 'write':7A,87C,117C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{"fix":{"at":"2026-10-27T17:38:26Z","by":"analyst","run_id":902},"workarounds":{"at":"2026-10-27T17:38:26Z","by":"analyst","run_id":902}},"analyst_revisit_at":null,"first_public_at":"2026-10-27T17:17:02+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"support@hackerone.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-77167","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77167","severity":null,"published_at":"2026-10-27T17:17:02+00:00","modified_at":"2026-10-27T17:17:02+00:00","first_seen_at":"2026-10-27T17:32:46+00:00","fetched_at":"2026-10-27T17:32:46+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-77167:902","url":null,"severity":null,"published_at":"2026-10-27T17:38:26+00:00","modified_at":"2026-10-27T17:38:26+00:00","first_seen_at":"2026-10-27T17:38:26+00:00","fetched_at":"2026-10-27T17:38:26+00:00","note":"Read Nextcloud GHSA-5572-968j-v7g5 (vendor advisory, High 7.5, published 2026-10-27). Page does not print the CVE id; matched by title/impact text, so link is inferred. No exploitation or PoC found; no social search done."}],"documents":[{"id":7195,"url":"https://github.com/nextcloud/security-advisories/security/advisories/GHSA-5572-968j-v7g5","title":"Nextcloud GHSA-5572-968j-v7g5: Unauthenticated Persistent DoS via Federated Share Injection","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}