CVE-2026-55640

Name of the Vulnerable Software and Affected Versions Nextcloud MCP Server versions prior to 0.117.2

Description The POST /webhooks/nextcloud endpoint lacks authentication by default because the WEBHOOK SECRET variable defaults to None and is not required during startup validation. When this secret is unset, the handle nextcloud webhook() function accepts unauthenticated requests. A network attacker can exploit this by providing a forged payload["user"]["uid"] field, which is used for Qdrant operations without an authenticated-session cross-check. This allows an attacker to delete or trigger the re-indexing of vector embeddings for any user, potentially destroying the entire semantic search index.

Recommendations Update to version 0.117.2. As a temporary mitigation, ensure that the WEBHOOK SECRET is explicitly configured and not left as None to enable authentication for the POST /webhooks/nextcloud endpoint.