# Cross-User Lock/Unlock via Absolute DAV Path

Nextcloud files_lock DAV plugin resolves absolute paths without checking session user, letting any authenticated user lock/unlock others' files and leak lock tokens.

- Payout: hidden
- Severity: medium
- Program: Nextcloud
- Found by (vendor credit): Balvant Chavda (0x0doteth)
- Found by: 0x0doteth
- Disclosed: 2026-09-17
- CVE: CVE-2026-45283, CVE-2026-82980
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/3301553
- Library page: https://bugbountylibrary.com/r/h1%3A3301553
- Tags: area:web domain:web impact:dos impact:integrity kind:bounty platform:hackerone sev:medium tech:rest technique:source-review vuln:access-control vuln:auth-bypass vuln:dos vuln:info-disclosure

**Target:** WebDAV endpoint /remote.php/dav/files/<userId>/<path> (files_lock app)
**Root cause:** LockPlugin::httpLock/httpUnlock call getFileFromAbsoluteUri on the raw request URI, which parses the <userId> segment and opens that user's folder without comparing it to the authenticated session user.
**Steps:**
1. Enable files_lock: `occ app:enable files_lock`; create users alice and admin.
2. As alice, upload a file via PUT to `/remote.php/dav/files/alice/poc.txt`.
3. As admin, send `LOCK /remote.php/dav/files/alice/poc.txt` with header `X-User-Lock: 1` -> 200, lock applied to alice's file.
4. As alice, PUT to the same path -> 423 Locked (DoS confirmed).
5. For token leak: as alice, send LOCK with `<D:lockinfo>` XML body to get a Lock-Token.
6. As admin, send `UNLOCK /remote.php/dav/files/alice/poc.txt` with `X-User-Lock: 1` -> 423 response body contains `<nc:lock-token>` of alice's lock.
7. As admin, send `UNLOCK` with `Lock-Token: <opaquelocktoken:LEAKED>` -> 204, lock removed.
8. As alice, PUT succeeds -> 204.
**How found:** Code review of LockPlugin and FileService: noticed getFileFromAbsoluteUri splits URI and calls getUserFolder($userId) directly, with no comparison to IUserSession user; also spotted getLockProperties/OCS controller returning lock token inside UnauthorizedUnlockException 423 responses.
**Exploitation:** Attacker with any account sends LOCK/UNLOCK requests to victim's absolute DAV path with X-User-Lock header; server resolves victim's folder from URI, applies attacker-owned lock (write DoS) or returns victim's lock token in 423 body, which attacker replays in a standard UNLOCK to clear client locks.
**Insight:** When a DAV/REST handler derives the target owner from the URL path rather than the session, test cross-tenant paths with the same auth; also check error paths (423/403) for credential-like secrets such as lock tokens echoed back to unauthorized callers.