---
id: "CVE-2026-77167"
kind: "vulnerability"
aliases: ["CVE-2026-77167"]
title: "Nextcloud federated share endpoint lets attackers write rows and cause denial of service"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "nextcloud-server", "fixed": ["34.0.2", "33.0.7", "32.0.13", "31.0.15", "30.0.18", "29.0.17", "28.0.15", "27.1.12", "26.0.14", "25.0.14", "24.0.13", "23.0.13", "22.2.11"], "affected": ">= 22.0.0 (all branches 22 to 34, before patched releases)", "ecosystem": "vendor"}]
ecosystems: []
tags: ["denial-of-service", "federated-sharing", "nextcloud", "other", "self-hosted"]
not_affected_if: ["federated-sharing-disabled"]
published_at: "2026-10-27T17:17:02+00:00"
first_seen_at: "2026-10-27T17:32:46+00:00"
updated_at: "2026-10-27T17:38:26+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-77167", "first_seen_at": "2026-10-27T17:32:46+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-27T17:38:26+00:00"}]
---

# Nextcloud federated share endpoint lets attackers write rows and cause denial of service

An unauthenticated attacker can abuse the federated share endpoint to insert arbitrary rows into the oc_share_external database table, and those rows never expire. The injected rows trigger three denial-of-service conditions that recur every 24 hours while the rows remain.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:nextcloud-server affected >= 22.0.0 (all branches 22 to 34, before patched releases) fixed 34.0.2, 33.0.7, 32.0.13, 31.0.15, 30.0.18, 29.0.17, 28.0.15, 27.1.12, 26.0.14, 25.0.14, 24.0.13, 23.0.13, 22.2.11

## How to check

Check your Nextcloud version (Admin > Overview, or occ status) against the patched list. Look for unexpected rows in the oc_share_external table and check whether federated share receiving is enabled.

## Fix

Upgrade Nextcloud Server to 34.0.2, 33.0.7 or 32.0.13 (older branches: 31.0.15, 30.0.18, 29.0.17, 28.0.15, 27.1.12, 26.0.14, 25.0.14, 24.0.13, 23.0.13, 22.2.11). Enterprise: 34.0.2, 33.0.7, 32.0.13, 31.0.14.8, 30.0.17.12, 29.0.16.19, 28.0.14.20, 27.1.11.29. Workaround: disable receiving federated sharing.

## Timeline

- 2026-10-27T17:32:46+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-77167
- 2026-10-27T17:38:26+00:00 analyst — Read Nextcloud GHSA-5572-968j-v7g5 (vendor advisory, High 7.5, published 2026-10-27). Page does not print the CVE id; matched by title/impact text, so link is inferred. No exploitation or PoC found; no social search done.

## Documents

- [advisory] Nextcloud GHSA-5572-968j-v7g5: Unauthenticated Persistent DoS via Federated Share Injection https://github.com/nextcloud/security-advisories/security/advisories/GHSA-5572-968j-v7g5

## From the sources

Abusing the federated share endpoint, an attacker can write arbitrary rows into the oc_share_external database table. These rows persist indefinitely — there is no automatic cleanup mechanism. Three distinct denial-of-service conditions follow from this write primitive, all triggered from the same unauthenticated source and all self-renewing on a 24-hour cycle for as long as the injected rows remain in the database.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_