CVE-2023-49103: ownCloud graphapi credential disclosure, actively exploited
The short version: ownCloud's graphapi app ships a third-party library that, when its URL is requested, prints the server's full PHP environment via phpinfo — and in containerized deployments those environment variables include the ownCloud admin password, mail credentials, and license key. No authentication is needed. It's in CISA's KEV catalog, and disabling the app alone does not fix it. If you run graphapi 0.2.x/0.3.x below the fixed builds, patch and rotate. Steady hands — but move.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | Moderate — unauthenticated disclosure of admin credentials in container deployments (see below) |
| CVSS v3.1 (NVD) | 7.5 — High · AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| CVSS (CNA/MITRE) | 10.0 — Critical · AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
| EPSS | ~78.43% · 99.54th percentile (2026-07-17) |
| In CISA KEV? | Yes — remediation was due 2023-12-21 |
| Known exploited? | Yes — mass exploitation after disclosure |
| Vulnerability type | CWE-200 exposure of sensitive information (phpinfo) → disclosure of admin password and secrets |
| Requires authenticated session? | No — unauthenticated |
| Affected | ownCloud owncloud/graphapi 0.2.x before 0.2.1 and 0.3.x before 0.3.1 |
| Fixed in | graphapi 0.2.1 and 0.3.1 |
What you need to know
ownCloud is a self-hosted file-sync-and-share platform, frequently internet-facing. The graphapi app bundles a third-party GetPhpInfo.php library exposed at a URL that, when reached, returns a full phpinfo dump — and phpinfo lists every environment variable of the web server. In containerized deployments those variables commonly carry the ownCloud admin password, the mail server credentials, and the license key.
Two details make it sharper than a typical info leak:
- It's unauthenticated. Anyone who can reach the URL gets the dump.
- Disabling graphapi is not enough. ownCloud specifically warned that turning the app off does not remove the exposure — you need the fixed version, and you must rotate.
How serious we see it
Moderate — and reasonably rated Critical in the container deployments where the admin password leaks.
This is a textbook CVSS-gap case: NVD scores it 7.5 as confidentiality-only, while the CNA scores it a full 10.0 to capture what the disclosed secrets enable. We land at High as our steady headline, and we'd treat any containerized instance as effectively Critical, because leaking the administrator credential is a straight path to account takeover. The bounded, reassuring part: it affects specific graphapi versions, the fixes are published, and exposure is quick to determine — but a leaked password stays leaked until you rotate it.
Recommendations
- Patch now. Upgrade the ownCloud
graphapiapp to 0.2.1 or 0.3.1 (or later). - Rotate everything that could have leaked — don't skip this. Change the ownCloud admin password, mail credentials, license key, and any other secrets in the container environment. Disabling the app is not sufficient.
- Hunt. Review web logs for requests to the graphapi
GetPhpInfo.phppath and for follow-on admin logins. - Reduce exposure. Keep ownCloud administration behind trusted networks where feasible.
- Confirm your exposure first. Verify whether you run ownCloud with the graphapi app and which version.
How BreachRisk sees it
BreachRisk discovers internet-facing ownCloud instances from little more than your domain, fingerprints the platform, and flags exposure tied to this KEV-listed, actively exploited flaw — surfaced at the top of your results because it's in KEV and because a leaked admin password is about as high-impact as an "information disclosure" gets. We detect and prioritize the exposed, affected instance; the outside-in view means it was already on your radar.