Fortress07

**Name of the Vulnerable Software and Affected Versions** Nextcloud MCP Server versions prior to 0.117.2 **Description** The `POST /webhooks/nextcloud` endpoint lacks authentication by default because the `WEBHOOK SECRET` variable defaults to `None` and is not required during startup validation. When this secret is unset, the `handle nextcloud webhook()` function accepts unauthenticated requests. A network attacker can exploit this by providing a forged `payload["user"]["uid"]` field, which is used for Qdrant operations without an authenticated-session cross-check. This allows an attacker to delete or trigger the re-indexing of vector embeddings for any user, potentially destroying the entire semantic search index. **Recommendations** Update to version 0.117.2. As a temporary mitigation, ensure that the `WEBHOOK SECRET` is explicitly configured and not left as `None` to enable authentication for the `POST /webhooks/nextcloud` endpoint.