Nextcloud Federated Share Endpoint Write RCE via oc_share_external Table
CVE-2026-77167 Published on October 27, 2026
Abusing the federated share endpoint, an attacker can write arbitrary rows into the oc_share_external database table. These rows persist indefinitely there is no automatic cleanup mechanism. Three distinct denial-of-service conditions follow from this write primitive, all triggered from the same unauthenticated source and all self-renewing on a 24-hour cycle for as long as the injected rows remain in the database.
Weakness Type
What is a Resource Exhaustion Vulnerability?
The software does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
CVE-2026-77167 has been classified to as a Resource Exhaustion vulnerability or weakness.
Products Associated with CVE-2026-77167
Want to know whenever a new CVE is published for Nextcloud Server? stack.watch will email you.
Affected Versions
Nextcloud server:- Version 22.0.0, <= 34.0.0 is affected.