CVE-2026-82980 Details

A vulnerability in the WebDAV handling of Nextcloud's DAV plugin allows any authenticated user to lock or unlock files belonging to other users. This issue arises because the plugin processes absolute file paths without verifying that the path corresponds to the authenticated user. As a result, an attacker can disrupt a victim's file access by locking their files, which prevents them from being edited or deleted. Additionally, the application inadvertently discloses lock tokens to unauthorized users, enabling them to remove locks from files of their choice.

To address this vulnerability, Nextcloud should implement checks in the DAV plugin to ensure that file operations are scoped to the authenticated user. This includes verifying user IDs against the session user before processing lock requests. Additionally, the application should be updated to prevent the disclosure of lock tokens to unauthorized users.