CVE-2026-77167

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-77167", "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "state": "PUBLISHED", "assignerShortName": "hackerone", "dateReserved": "2026-08-20T15:00:00.606Z", "datePublished": "2026-10-27T16:15:34.778Z", "dateUpdated": "2026-11-04T20:25:10.944Z"}, "containers": {"cna": {"descriptions": [{"lang": "en", "value": "Abusing the federated share endpoint, an attacker can write arbitrary rows into the oc_share_external database table. These rows persist indefinitely \u2014 there is no automatic cleanup mechanism. Three distinct denial-of-service conditions follow from this write primitive, all triggered from the same unauthenticated source and all self-renewing on a 24-hour cycle for as long as the injected rows remain in the database."}], "affected": [{"defaultStatus": "unaffected", "vendor": "Nextcloud", "product": "server", "versions": [{"version": "22.0.0", "status": "affected", "lessThanOrEqual": "34.0.0", "versionType": "semver"}]}], "references": [{"url": "https://hackerone.com/reports/3679640"}], "metrics": [{"cvssV3_0": {"version": "3.0", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH"}}], "problemTypes": [{"descriptions": [{"type": "CWE", "lang": "en", "cweId": "CWE-400", "description": "CWE-400 Uncontrolled Resource Consumption"}]}], "credits": [{"lang": "en", "value": "ncsc_nl", "type": "finder"}], "providerMetadata": {"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "shortName": "hackerone", "dateUpdated": "2026-10-27T16:15:34.778Z"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-04T20:07:41.893986Z", "id": "CVE-2026-77167", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-04T20:25:10.944Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-77167", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-04T20:07:41.893986Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-04T20:07:42.844Z"}}], "cna": {"credits": [{"lang": "en", "type": "finder", "value": "ncsc_nl"}], "metrics": [{"cvssV3_0": {"version": "3.0", "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}}], "affected": [{"vendor": "Nextcloud", "product": "server", "versions": [{"status": "affected", "version": "22.0.0", "versionType": "semver", "lessThanOrEqual": "34.0.0"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://hackerone.com/reports/3679640"}], "descriptions": [{"lang": "en", "value": "Abusing the federated share endpoint, an attacker can write arbitrary rows into the oc_share_external database table. These rows persist indefinitely \u2014 there is no automatic cleanup mechanism. Three distinct denial-of-service conditions follow from this write primitive, all triggered from the same unauthenticated source and all self-renewing on a 24-hour cycle for as long as the injected rows remain in the database."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-400", "description": "CWE-400 Uncontrolled Resource Consumption"}]}], "providerMetadata": {"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "shortName": "hackerone", "dateUpdated": "2026-10-27T16:15:34.778Z"}}}, "cveMetadata": {"cveId": "CVE-2026-77167", "state": "PUBLISHED", "dateUpdated": "2026-11-04T20:25:10.944Z", "dateReserved": "2026-08-20T15:00:00.606Z", "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "datePublished": "2026-10-27T16:15:34.778Z", "assignerShortName": "hackerone"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "server", "vendor": "Nextcloud", "versions": [{"lessThanOrEqual": "34.0.0", "status": "affected", "version": "22.0.0", "versionType": "semver"}]}], "source": "support@hackerone.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Abusing the federated share endpoint, an attacker can write arbitrary rows into the oc_share_external database table. These rows persist indefinitely \u2014 there is no automatic cleanup mechanism. Three distinct denial-of-service conditions follow from this write primitive, all triggered from the same unauthenticated source and all self-renewing on a 24-hour cycle for as long as the injected rows remain in the database."}], "id": "CVE-2026-77167", "lastModified": "2026-11-04T21:18:14.233", "metrics": {"cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "support@hackerone.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-77167", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-04T20:07:41.893986Z", "version": "2.0.3"}}]}, "published": "2026-10-27T17:17:02.673", "references": [{"source": "support@hackerone.com", "url": "https://hackerone.com/reports/3679640"}], "sourceIdentifier": "support@hackerone.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-400"}], "source": "support@hackerone.com", "type": "Secondary"}]}

{"bugzilla": {"description": "nextcloud: Nextcloud: Denial of Service via federated share endpoint abuse", "id": "2562272", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2562272"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-770", "details": ["Abusing the federated share endpoint, an attacker can write arbitrary rows into the oc_share_external database table. These rows persist indefinitely \u2014 there is no automatic cleanup mechanism. Three distinct denial-of-service conditions follow from this write primitive, all triggered from the same unauthenticated source and all self-renewing on a 24-hour cycle for as long as the injected rows remain in the database.", "A flaw was found in Nextcloud. An unauthenticated remote attacker can abuse the federated sharing endpoint to inject arbitrary rows into the database. Because these entries are never automatically cleaned up, they cause persistent Denial of Service (DoS) conditions that disrupt system availability."], "name": "CVE-2026-77167", "public_date": "2026-10-27T16:15:34Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-77167\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-77167\nhttps://hackerone.com/reports/3679640"], "statement": "Red Hat Product Security rates this vulnerability as Important because an unauthenticated remote attacker can exploit public federated sharing interfaces to cause recurring denial of service without requiring user interaction or specialized privileges. Nextcloud is not included or supported within core Red Hat Enterprise Linux products, though packages are available in community repositories like Fedora and EPEL. Systems exposing federation capabilities face persistent availability degradation due to unbounded database table bloat.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[22.0.0,34.0.0]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "server", "source": "cna", "vendor": "Nextcloud"}, "product": "server", "vendor": "nextcloud"}], "created": "2026-10-27T17:45:06.456619+00:00", "updated": "2026-10-30T02:45:07.657627+00:00", "vendors": ["nextcloud", "nextcloud$PRODUCT$server"]}