CVE-2026-82980

Overview

An improper authorization vulnerability exists in the WebDAV plugin where absolute request URIs are resolved without validating user ownership. Any authenticated user can lock or unlock files belonging to other users, leading to denial of service or unauthorized modification control. This issue matters because it impacts data integrity and availability in multi-tenant or shared file environments.

Description

Any authenticated user can lock or unlock files they do not own by targeting absolute WebDAV paths of other users. The DAV plugin resolves files from the absolute request URI without verifying that the path segment matches the authenticated session user. This enables: Cross-user manual locks : attacker locks a victim's files, blocking writes (PUT/MOVE/DELETE, editor saves). Lock-token disclosure: the app returns the lock token to unauthorized callers, enabling them to remove token-based locks (client locks) of other users.

Impact

The vulnerability primarily impacts data availability and integrity (CIA: Low Confidentiality, High Integrity, High Availability) for all authenticated users sharing the same file repository. Attackers can perform cross-user manual locks to block victim file writes or leverage token disclosure to remove legitimate client locks. Affected parties include organization users and administrators relying on strict access isolation within WebDAV shares.

Remediation

Apply the official vendor patch or update to the latest version of the WebDAV plugin where absolute path resolution is restricted. Ensure authorization checks validate that the target path segment matches the authenticated session user before processing lock or unlock operations. Audit existing file locks for unexpected states and review WebDAV access logs for suspicious cross-user activity.

Risk context

Rated as a medium severity vulnerability with a CVSS v3 score of 6.3, representing moderate risk to multi-user environments. EPSS data is currently unavailable. Remediation should be scheduled during the next standard maintenance window.

Affected products

• WebDAV plugin
• DAV file management systems