{"id":"CVE-2026-84473","kind":"vulnerability","aliases":["CVE-2026-84473"],"related":[],"title":"ownCloud server: WebDAV endpoint allows unlimited password guessing","description":"Authentication Bypass / Missing Brute-Force Protection in remote.php/webdav/ in ownCloud ownCloud server 10.16.3 allows an unauthenticated remote attacker to perform unlimited online password guessing against WebDAV accounts via repeated HTTP Basic Authentication requests to the WebDAV endpoint.","summary":"ownCloud server 10.16.3 lacks brute-force protection on the WebDAV endpoint remote.php/webdav/. An unauthenticated attacker can make unlimited HTTP Basic Authentication attempts to guess WebDAV account passwords.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["owncloud","self-hosted","vendor","webdav"],"not_affected_if":["unknown"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-06T19:17:57+00:00","first_seen_at":"2026-11-06T19:43:49+00:00","triaged_at":"2026-11-06T19:46:03+00:00","updated_at":"2026-11-06T19:46:03+00:00","category":"vendor","confidence":0.5,"triage":{"at":"2026-11-06T19:46:03Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"ownCloud server: WebDAV endpoint allows unlimited password guessing","impact":"medium","summary":"ownCloud server 10.16.3 lacks brute-force protection on the WebDAV endpoint remote.php/webdav/. An unauthenticated attacker can make unlimited HTTP Basic Authentication attempts to guess WebDAV account passwords.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["owncloud","self-hosted","webdav"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker guesses WebDAV account passwords and gains file access","analyst_note":"Check the NVD entry and the ownCloud security advisory for affected version range, fixed version and any mitigation setting.","how_to_check":"- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"ownCloud server 10.16.3 instances with WebDAV reachable by an attacker are described in the sources as affected. The sources do not say which other versions or configurations are affected, or whether a rate limiter or other control can mitigate it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000654,"input_tokens":4246,"output_tokens":458,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':10A,13A '-84473':11A,14A '/webdav/':61C '/webdav/.':35B '10.16.3':23B,66C 'account':49B,80C 'allow':5A,67C 'attack':38B,71C 'attempt':45B 'authent':44B,51C,85C 'basic':43B,84C 'brute':26B,55C 'brute-forc':25B,54C 'bypass':52C 'cve':9A,12A 'endpoint':4A,32B,90C 'forc':27B,56C 'guess':8A,47B,77C 'host':18B 'http':42B,83C 'lack':24B 'make':40B 'miss':53C 'onlin':75C 'owncloud':1A,15B,21B,63C,64C 'password':7A,50B,76C 'perform':73C 'protect':28B,57C 'remot':70C 'remote.php':34B,60C 'remote.php/webdav/':59C 'remote.php/webdav/.':33B 'repeat':82C 'request':86C 'self':17B 'self-host':16B 'server':2A,22B,65C 'unauthent':37B,69C 'unlimit':6A,41B,74C 'vendor':19B 'via':81C 'webdav':3A,20B,31B,48B,79C,89C","nicknames":[],"mitigations":[],"who_affected":"ownCloud server 10.16.3 instances with WebDAV reachable by an attacker are described in the sources as affected. The sources do not say which other versions or configurations are affected, or whether a rate limiter or other control can mitigate it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["owncloud","selfhosted","unknown","vendor","webdav"],"campaign_type":null,"search_a":"'-2026':10A,13A '-84473':11A,14A 'allow':5A 'cve':9A,12A 'endpoint':4A 'guess':8A 'owncloud':1A 'password':7A 'server':2A 'unlimit':6A 'webdav':3A","search_b":"'/webdav/.':35B '10.16.3':23B 'account':49B 'attack':38B 'attempt':45B 'authent':44B 'basic':43B 'brute':26B 'brute-forc':25B 'endpoint':32B 'forc':27B 'guess':47B 'host':18B 'http':42B 'lack':24B 'make':40B 'owncloud':15B,21B 'password':50B 'protect':28B 'remote.php':34B 'remote.php/webdav/.':33B 'self':17B 'self-host':16B 'server':22B 'unauthent':37B 'unlimit':41B 'vendor':19B 'webdav':20B,31B,48B","search_c":"'/webdav/':61C '10.16.3':66C 'account':80C 'allow':67C 'attack':71C 'authent':51C,85C 'basic':84C 'brute':55C 'brute-forc':54C 'bypass':52C 'endpoint':90C 'forc':56C 'guess':77C 'http':83C 'miss':53C 'onlin':75C 'owncloud':63C,64C 'password':76C 'perform':73C 'protect':57C 'remot':70C 'remote.php':60C 'remote.php/webdav/':59C 'repeat':82C 'request':86C 'server':65C 'unauthent':69C 'unlimit':74C 'via':81C 'webdav':79C,89C","first_public_at":"2026-11-06T19:17:57+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-84473","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84473","severity":null,"published_at":"2026-11-06T19:17:57+00:00","modified_at":"2026-11-06T19:17:57+00:00","first_seen_at":"2026-11-06T19:43:49+00:00","fetched_at":"2026-11-06T19:43:49+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}