CVE-2026-82980 in Files Lock
Summary
by MITRE • 09/18/2026
Any authenticated user can lock or unlock files they do not own by targeting absolute WebDAV paths of other users. The DAV plugin resolves files from the absolute request URI without verifying that the path segment matches the authenticated session user. This enables:
Cross-user manual locks : attacker locks a victim's files, blocking writes (PUT/MOVE/DELETE, editor saves). Lock-token disclosure: the app returns the lock token to unauthorized callers, enabling them to remove token-based locks (client locks) of other users.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/18/2026
The vulnerability described constitutes a critical authorization bypass within the WebDAV plugin implementation, specifically affecting file locking mechanisms for authenticated users. The core technical flaw lies in the server-side resolution logic which relies exclusively on absolute paths provided directly in the request URI without performing any validation against the identity of the currently authenticated session. In standard secure implementations, when an operation targets a specific resource path, the system must verify that the requesting user possesses ownership or appropriate permissions for that specific resource relative to their account context. Here, the application fails to map the requested absolute WebDAV path back to the authorized scope of the logged-in user, effectively treating all authenticated sessions as having unrestricted access to any file on the server regardless of ownership boundaries. This represents a fundamental failure in object-level access control where the security boundary is defined by the request parameters rather than by the identity and privileges of the actor making the request.
From an operational impact perspective, this flaw allows for two distinct categories of malicious activity that can severely disrupt organizational workflows and compromise data integrity. First, attackers can execute cross-user manual locks against files they do not own. By sending a LOCK request with an absolute path pointing to a victim's document, the attacker forces the server to place a lock on that file. Since most collaborative editing platforms rely on these WebDAV locks to prevent concurrent modifications and data corruption, this action effectively blocks legitimate users from writing, moving, or deleting their own files. This results in a denial of service for specific individuals or teams, halting productivity and potentially causing loss of unsaved work if editors are forced to close without saving due to perceived file unavailability.
Secondly, the vulnerability facilitates lock-token disclosure which leads to unauthorized modification of locking states. The application erroneously returns the generated lock token in responses intended for unauthorized callers. In WebDAV protocols, a lock token is required to unlock or modify a locked resource. By obtaining these tokens through malformed requests targeting other users' files, an attacker can subsequently send UNLOCK or LOCK requests with valid tokens belonging to victims. This allows the adversary not only to remove protective locks placed by others but also to manipulate locking states arbitrarily. This undermines the integrity of the collaboration model where lock management is critical for maintaining consistent file versions and preventing race conditions during simultaneous edits.
In terms of industry standard classification, this vulnerability aligns with CWE-284 Improper Access Control, specifically reflecting a failure in authorization checks that allow users to access resources belonging to other entities. It also maps closely to CWE-639 Authorization Bypass Through User-Controlled Key or Identifier, as the attacker controls the resource identifier (the file path) and bypasses ownership verification. Within the MITRE ATT&CK framework, this behavior corresponds to T1084 Client Side Proxy Abuse if exploited via automated tools, but more accurately fits under lateral movement techniques such as T1530 Data from Cloud Storage Objects or T1567 Exfiltration Over Web Service depending on subsequent actions. The primary tactic is Privilege Escalation through Authorization Bypass (T1078) and Impact categories including Denial of Service via resource manipulation (TA0040).
To mitigate this vulnerability, immediate remediation requires implementing strict server-side validation that correlates the requested absolute path with the authenticated user's account context. The application must resolve the file system or database entry for the given URI and verify that the owner ID matches the session user ID before processing any LOCK, UNLOCK, or PROPFIND requests. Additionally, lock tokens should never be returned in responses to unauthorized access attempts; instead, a 403 Forbidden status code should be issued if the user lacks permission on the target resource. Long-term fixes involve adopting principle of least privilege architectures where all file operations are scoped strictly within the user's designated directory tree or explicitly granted shared folders, ensuring that absolute paths cannot be used to escape these boundaries without explicit administrative override capabilities.