CVE-2026-55640
Gravedad CVSS v3.1:
CRÍTICA
Tipo:
CWE-306
Ausencia de autenticación para una función crítica
Fecha de publicación:
25/08/2026
Última modificación:
25/08/2026
Descripción
*** Pendiente de traducción *** Nextcloud MCP Server is a production-ready MCP server that connects AI assistants to a Nextcloud instance. Prior to 0.117.2, the POST /webhooks/nextcloud endpoint in nextcloud_mcp_server/vector/webhook_receiver.py has no authentication by default because WEBHOOK_SECRET defaults to None and startup validation does not require it. When WEBHOOK_SECRET is unset, handle_nextcloud_webhook() accepts unauthenticated requests. The payload["user"]["uid"] field parsed in nextcloud_mcp_server/vector/webhook_parser.py is attacker-controlled and is used without an authenticated-session cross-check for Qdrant operations, allowing a network attacker to delete or trigger re-indexing of vector embeddings for any user and to destroy the semantic search index by sending forged deletion events. This issue is fixed in version 0.117.2.
Impacto
Puntuación base 3.x
9.10
Gravedad 3.x
CRÍTICA