Security readout for executives and security teams
Plain-English summary
This flaw let a logged-in user with read-only access to a shared area add new files there. They could not change existing files. The business concern is unauthorized content appearing in shared storage, especially where external users or broad sharing were used.
Executive priority
Treat as a moderate legacy-platform cleanup issue. Prioritize if the service supports external collaborators, regulated data, or broad internal sharing. The issue is older and authenticated, but unauthorized file creation can undermine trust in shared repositories.
Technical view
CVE-2016-9461 is a WebDAV COPY permission-check flaw in Nextcloud Server before 9.0.52 and ownCloud Server before 9.0.4. The endpoint did not properly enforce edit permissions, allowing authenticated read-only share users to create files. It maps to CWE-275.
Likely exposure
Exposure is most likely in legacy Nextcloud or ownCloud deployments below the fixed versions, where authenticated users have read-only shared-folder access through WebDAV. Current deployments are only relevant if they remain on these old release lines.
Exploitation context
The source bundle does not show CISA KEV listing or active exploitation evidence. Exploitation requires an authenticated account with access to a read-only share. The documented impact is adding new files, not modifying existing ones.
Researcher notes
Evidence is strong for affected products, versions, and permission impact. The bundle lacks CVSS details and does not prove exploit-in-the-wild activity. Keep validation focused on version state, WebDAV exposure, and read-only share behavior without attempting offensive reproduction.
Mitigation direction
- Upgrade Nextcloud Server to 9.0.52 or later if running an affected build.
- Upgrade ownCloud Server to 9.0.4 or later if running an affected build.
- Review vendor advisories for any deployment-specific guidance or backported fixes.
- Audit read-only shares for unexpected files added before remediation.
Validation and detection
- Inventory Nextcloud and ownCloud server versions across production and backups.
- Confirm affected instances expose WebDAV and support shared read-only folders.
- Review logs for unusual WebDAV COPY activity by read-only share users.
- Verify fixed-version deployment using vendor release or package metadata.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-275: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2016-9461 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://owncloud.org/security/advisory/?id=oc-sa-2016-014CVE reference · x_refsource_MISC
- https://nextcloud.com/security/advisory/?id=nc-sa-2016-004CVE reference · x_refsource_MISC
- https://github.com/owncloud/core/commit/acbbadb71ceee7f01da347f7dcd519beda78cc47CVE reference · x_refsource_MISC
- https://github.com/owncloud/core/commit/c0a4b7b3f38ad2eaf506484b3b92ec678cb021c9CVE reference · x_refsource_MISC
- https://github.com/owncloud/core/commit/121a3304a0c37ccda0e1b63ddc528cba9121a36eCVE reference · x_refsource_MISC
- https://github.com/owncloud/core/commit/0622e635d97cb17c5e1363e370bb8268cc3d2547CVE reference · x_refsource_MISC
- https://hackerone.com/reports/145950CVE reference · x_refsource_MISC
- https://github.com/nextcloud/server/commit/3491400261c1454a9a30d3ec96969573330120ccCVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Permission Issues
Permission Issues represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.