CVE-2026-84473 · Vendor
NO FIX YET
ownCloud server 10.16.3 lacks brute-force protection on the WebDAV endpoint remote.php/webdav/. An unauthenticated attacker can make unlimited HTTP Basic Authentication attempts to guess WebDAV account passwords.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
ownCloud server 10.16.3 instances with WebDAV reachable by an attacker are described in the sources as affected. The sources do not say which other versions or configurations are affected, or whether a rate limiter or other control can mitigate it.
Not affected if unknown
Who cares owncloud, self-hosted, webdav
Unknown from the sources.
No fix yet, per the sources.
Authentication Bypass / Missing Brute-Force Protection in remote.php/webdav/ in ownCloud ownCloud server 10.16.3 allows an unauthenticated remote attacker to perform unlimited online password guessing against WebDAV accounts via repeated HTTP Basic Authentication requests to the WebDAV endpoint.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.