ACTIVELY EXPLOITED
CVE-2023-49103: ownCloud graphapi Information Disclosure Vulnerability
| Vendor | ownCloud |
|---|---|
| Product | ownCloud graphapi |
| Actively exploited | Yes |
| Added to CISA KEV | 30 Nov 2023 |
| CISA federal deadline | 21 Dec 2023 |
Required action (CISA's text)
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Description (NVD)
ownCloud graphapi contains an information disclosure vulnerability that can reveal sensitive data stored in phpinfo() via GetPhpInfo.php, including administrative credentials.
SOURCES
Other ownCloud flaws
Data from NVD, CISA KEV, FIRST EPSS and vendor advisories. Updated 10 Nov 2026.