The vulnerability appears in the WebDAV endpoint of ownCloud Server 10.16.3 and allows an unauthenticated attacker to repeatedly submit HTTP Basic Authentication requests without any limitation. Because the system does not enforce a lockout or rate‑limiting policy, the attacker can perform unlimited password guessing against WebDAV accounts. If a guess succeeds, the attacker obtains the account’s credentials and can access all files and data available through WebDAV, compromising the confidentiality and integrity of the system. The impact extends to any privileged account that has WebDAV access, potentially providing full control over the server’s file storage.

This flaw targets Kiteworks’ distribution of ownCloud Server version 10.16.3. Any deployment that exposes the remote.php/webdav/ endpoint over HTTP Basic Authentication is vulnerable, regardless of network placement, unless additional controls are applied.

The CVSS score is not disclosed, EPSS data is unavailable, and the vulnerability is not listed in the CISA KEV catalog, so there is no public metric for exploitation probability. However, the absence of brute‑force protection means an attacker can attempt as many guesses as desired; the likely attack vector is remote over the WebDAV protocol, requiring only network connectivity to the target. The combination of unlimited guessing and direct credential theft gives the vulnerability a high likelihood of success, making the risk significant for environments where WebDAV is enabled.