Executive brief
nextcloud-mcp-server is a connector that integrates Nextcloud file services with a semantic search system using vector embeddings. When the optional `WEBHOOK_SECRET` configuration is left unset (the default), an attacker on the network can send unauthenticated POST requests to the webhook endpoint to delete or corrupt vector embeddings for any user's documents. This allows mass destruction of the semantic search index without any credentials, forcing a full re-index to recover.
Technical details
The vulnerability is a missing authentication check (CWE-306) in the `POST /webhooks/nextcloud` endpoint. The authentication validation in `webhook_receiver.py` lines 55–67 is guarded by a conditional check on `WEBHOOK_SECRET`, which defaults to `None`. When unset, the entire authentication block is skipped and the endpoint accepts any POST request. Additionally, the `user_id` field is taken directly from the attacker-controlled JSON payload without validation against an authenticated session. An unauthenticated attacker with network access to port 8000 can craft a JSON payload with arbitrary `user.uid` and trigger deletion or re-indexing of vector embeddings for any user via the Qdrant backend. Mass deletion of documents across all users is possible by looping over document IDs. The vulnerability is fixed in version 0.117.2 by enforcing `WEBHOOK_SECRET` at startup and rejecting unauthenticated requests with proper HMAC validation.
Affected products
- cbcoutinho nextcloud-mcp-server <= 0.117.1
Timeline
- 2026-08-25: disclosed: Published to GitHub Advisory Database
- 2026-08-25: patched: Version 0.117.2 released with fix