CVE-2026-82980

Name of the Vulnerable Software and Affected Versions Nextcloud (affected versions not specified)

Description An improper authorization issue exists in the DAV plugin where the system resolves files from the absolute request URI without verifying if the path segment matches the authenticated session user. This allows any authenticated user to lock or unlock files belonging to other users by targeting absolute WebDAV paths. This flaw can lead to cross-user manual locks, which block write operations such as PUT, MOVE, DELETE, and editor saves, as well as lock-token disclosure, allowing unauthorized users to remove token-based client locks of other users.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.