Abusing the federated share endpoint, an attacker can write arbitrary rows into the oc_share_external database table. These rows persist indefinitely, as there is no automatic cleanup mechanism. The injected rows give rise to three distinct denial‑of‑service conditions that are triggered from the same unauthenticated source and that self‑renew on a 24-hour cycle for as long as the rows remain in the database, allowing the server to experience repeated disruptions.

Any installation of the Nextcloud server that includes the federated share endpoint is impacted. No specific version information is supplied, so all current releases using this feature should be considered potentially vulnerable until a vendor fix is released.

The CVSS score of 7.5 indicates a high risk of service interruption. Because the EPSS score is not available, there is no current evidence of exploit activity, and the vulnerability is not listed in CISA’s KEV catalog. However, the attack is unauthenticated and can be performed on any exposed federated share endpoint, and the injected rows persist until removed, meaning the denial‑of‑service impact can recur automatically each day. The combination of these factors places the overall threat at a high priority for timely remediation.