Critical, CVSS 9.1PyPIAmendedPublished
nextcloud-mcp-server: Unauthenticated POST /webhooks/nextcloud allows arbitrary vector data deletion when WEBHOOK_SECRET is unset ( default )
CVE-2026-55640 · GHSA-8vh3-g2qg-2h2c
- Affected
- PyPI nextcloud-mcp-server <= 0.117.1
- Fixed in
- 0.117.2· Vendor fix available
- Issue
- The POST /webhooks/nextcloud endpoint has no authentication by default: WEBHOOKSECRET defaults to None and is never required by startup validation. When unset, the receiver accepts any unauthenticated POST. The userid is taken directly from the attacker-supplied payload and passed to Qdrant, allowing an unauthenticated attacker to delete or corrupt vector embeddings for any user. Details Vulnerable file: nextcloudmcpserver/vector/webhookreceiver.py, function handlenextcloudwebhook(), lines 55-67 Root cause 1: Auth check is guarded by if secret: - skipped entirely when WEBHOOKSECRET is unset. Root cause 2: webhooksecret: str | None = None in config - no startup validator enforces it, even when vector sync is enabled. Trusted field: payload["user"]["uid"] in webhookparser.py is used as-is for all Qdrant operations - no cross-check against an authenticated session. webhookreceiver.py, lines 55-67: webhookparser.py, line 57: PoC No credentials required. Works on any deployment…
Recommended action: Upgrade to 0.117.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.