Database Injection Vulnerability in External Sharing Feature of a Popular Cloud Storage Solution

CVE-2026-77167

What is CVE-2026-77167?

The vulnerability allows an attacker to manipulate the federated share endpoint, resulting in the ability to insert arbitrary entries into the oc_share_external database table without authentication. These entries remain indefinitely due to the absence of an automatic cleanup system. This leads to multiple denial-of-service conditions, which can be triggered from a single unauthenticated source, and the effects persist on a 24-hour cycle as long as the malicious entries exist in the database. This poses significant risks for users of the affected cloud storage solution, potentially compromising system availability.

References