CVE-2026-82980: WebDAV Auth Bypass Vulnerability

CVE-2026-82980 Overview

CVE-2026-82980 is a broken authentication vulnerability [CWE-287] in a WebDAV (Web Distributed Authoring and Versioning) DAV plugin. Any authenticated user can lock or unlock files belonging to other users by targeting absolute WebDAV paths. The DAV plugin resolves files from the absolute request URI without verifying that the path segment matches the authenticated session user. Attackers can block writes to victim files, disrupt editor saves, and disclose lock tokens that permit removal of client-owned locks.

Critical Impact

Authenticated attackers can disrupt file availability across tenants by placing or removing WebDAV locks on files they do not own, blocking PUT, MOVE, DELETE, and editor save operations.

Affected Products

• Applications implementing the vulnerable WebDAV DAV plugin
• Specific vendor and version details not disclosed in the NVD entry
• See the HackerOne Report #3301553 for additional context

Discovery Timeline

• 2026-09-18 - CVE-2026-82980 published to the National Vulnerability Database
• 2026-09-18 - Last updated in NVD database

Technical Details for CVE-2026-82980

Vulnerability Analysis

The vulnerability lives in the WebDAV DAV plugin's request-handling logic. When the plugin receives a LOCK or UNLOCK request, it resolves the target resource from the absolute Request-URI. The plugin does not validate that the resolved path belongs to the authenticated session user.

This broken authorization enables two abuse patterns. First, an authenticated attacker can issue manual LOCK requests against another user's absolute WebDAV path, blocking subsequent writes such as PUT, MOVE, DELETE, and editor save operations. Second, the server returns the resulting lock token to the unauthorized caller. Possession of that token allows the attacker to submit UNLOCK requests against client-owned locks belonging to other users, removing legitimate locks and enabling further disruption.

The result is cross-user denial of file availability and integrity of the locking mechanism, all achievable with low-privileged authenticated access over the network.

Root Cause

The DAV plugin trusts the absolute Request-URI to identify the target resource but omits an authorization check tying that resource to the authenticated principal. The session user is authenticated, yet the path segment is not compared against the user's namespace before lock state mutations occur.

Attack Vector

Exploitation requires network access and valid credentials on the target application. The attacker sends crafted WebDAV LOCK or UNLOCK requests referencing absolute paths of files owned by other users. No user interaction is required. Full technical details are available in the HackerOne Report #3301553.

Detection Methods for CVE-2026-82980

Indicators of Compromise

• WebDAV LOCK or UNLOCK requests where the Request-URI path segment references a user directory that does not match the authenticated session principal
• Unexpected 423 Locked responses returned to users attempting PUT, MOVE, or DELETE operations on their own files
• Lock tokens issued in responses to requests originating from unrelated user sessions

Detection Strategies

• Correlate authenticated session user identifiers with the URI path in WebDAV access logs and alert on mismatches
• Track lock creation and removal events by principal and flag lock operations that affect resources outside the requester's namespace
• Monitor editor and sync clients for repeated save failures caused by unexpected locks

Monitoring Recommendations

• Enable verbose WebDAV request logging including method, Request-URI, authenticated user, and response status
• Aggregate lock and unlock activity per user and baseline normal behavior to surface anomalies
• Alert on any single account generating a high volume of LOCK requests targeting diverse user paths

How to Mitigate CVE-2026-82980

Immediate Actions Required

• Restrict WebDAV endpoint access to trusted networks or authenticated VPN sessions until a patch is applied
• Audit application logs for prior cross-user LOCK and UNLOCK activity and notify affected users
• Enforce least-privilege on accounts that can authenticate to the WebDAV service to reduce the attacker pool

Patch Information

No vendor advisory or fixed version is referenced in the NVD entry at time of publication. Review the HackerOne Report #3301553 for remediation status and monitor the upstream project for a security release that adds authorization checks binding the WebDAV Request-URI to the authenticated session user.

Workarounds

• Deploy a reverse proxy or WAF rule that rejects WebDAV LOCK and UNLOCK requests where the URI path does not begin with the authenticated user's namespace
• Temporarily disable the DAV plugin for tenants that do not require WebDAV locking functionality
• Rate-limit LOCK operations per authenticated principal to reduce disruption from abuse

# Example NGINX rule denying WebDAV LOCK/UNLOCK to paths outside the caller's namespace
# Requires an auth subrequest that sets $authenticated_user
location /webdav/ {
    if ($request_method ~ ^(LOCK|UNLOCK)$) {
        set $flag "";
        if ($uri !~ "^/webdav/$authenticated_user/") { set $flag "deny"; }
        if ($flag = "deny") { return 403; }
    }
    proxy_pass http://webdav_backend;
}