CVE-2020-36252
Description
ownCloud Server before 10.3.1 allows an attacker with a single outgoing share to access all file versions via predictable file IDs.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
ownCloud Server before 10.3.1 allows an attacker with a single outgoing share to access all file versions via predictable file IDs.
Vulnerability
In ownCloud Server versions 10.0.9 to 10.3.0, the files_versions app incorrectly uses privileged APIs, allowing an attacker who has at least one outgoing share from a victim to access any version of any file by guessing a numeric and sequential file ID. Affected versions: owncloud/core >= v10.0.9 and < v10.3.1 [1].
Exploitation
An attacker must be authenticated and have at least one outgoing share from the victim. The attacker then sends requests with predictable file IDs to access file versions. No additional privileges beyond the existing share are required [1].
Impact
The attacker can read all versions of all files belonging to the victim, including unshared files, leading to unauthorized information disclosure. The CVSS v3 base score is 6.8 (Medium) with high confidentiality impact [1].
Mitigation
Upgrade to ownCloud Server 10.3.1 or later. As a workaround, disable the files_versions app by running occ app:disable files_versions [1]. The advisory was published on February 28, 2020.
AI Insight generated on May 26, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected products
2- ownCloud/ownCloud Serverdescription
Patches
11 file changed · +2 −2
version.php+2 −2 modified@@ -25,10 +25,10 @@ // We only can count up. The 4. digit is only for the internal patchlevel to trigger DB upgrades // between betas, final and RCs. This is _not_ the public version number. Reset minor/patchlevel // when updating major/minor version number. -$OC_Version = [10, 3, 1, 0]; +$OC_Version = [10, 3, 1, 1]; // The human readable string -$OC_VersionString = '10.3.1 RC1'; +$OC_VersionString = '10.3.1'; $OC_VersionCanBeUpgradedFrom = [[8, 2, 11],[9, 0, 9],[9, 1]];
Vulnerability mechanics
Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
1- owncloud.com/security-advisories/access-to-all-file-versions/mitrex_refsource_MISC
News mentions
0No linked articles in our index yet.