CVE-2026-77167: High severity vulnerability
Abusing the federated share endpoint, an attacker can write arbitrary rows into the ocshareexternal database table. These rows persist indefinitely — there is no automatic cleanup mechanism. Three distinct denial-of-service conditions follow from this write primitive, all triggered from the same unauthenticated source and all self-renewing on a 24-hour cycle for as long as the injected rows remain in the database.
Event History
Frequently Asked Questions
Does exploitation require an authenticated account or user interaction?
No. The denial-of-service conditions can be triggered from an unauthenticated source, with no user interaction required.
Why can the impact continue after the initial request traffic stops?
Injected rows in the oc_share_external table persist indefinitely because there is no automatic cleanup mechanism. The resulting conditions renew on a 24-hour cycle for as long as those rows remain in the database.