CVE-2025-59716
📋 TL;DR
This vulnerability in ownCloud Guests allows unauthenticated attackers to enumerate valid pending guest user email addresses. Attackers can determine which email addresses have pending guest invitations by observing different server responses at the /apps/guests/register/{email}/{token} endpoint. This affects all ownCloud instances using the Guests app before version 0.12.5.
💻 Affected Systems
- ownCloud Guests app
📦 What is this software?
Guests by Owncloud
⚠️ Risk & Real-World Impact
Worst Case
Attackers could map all pending guest invitations, potentially identifying organizational structure, preparing targeted phishing campaigns, or discovering internal email naming conventions.
Likely Case
Information disclosure revealing which email addresses have pending guest access, enabling reconnaissance for further attacks.
If Mitigated
Limited information disclosure with no direct access to sensitive data or systems.
🎯 Exploit Status
Simple HTTP requests to the vulnerable endpoint with different email addresses can reveal valid pending users. The gist reference contains technical details.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.12.5
Vendor Advisory: https://marketplace.owncloud.com/apps/guests
Restart Required: No
Instructions:
1. Update ownCloud Guests app to version 0.12.5 or later via ownCloud marketplace or manual installation. 2. Verify the update completed successfully. 3. No server restart required.
🔧 Temporary Workarounds
Disable Guests app
linuxTemporarily disable the vulnerable Guests app if immediate patching isn't possible
occ app:disable guests
Web server blocking
allBlock access to the vulnerable endpoint using web server configuration
# For Apache: add 'RewriteRule ^/apps/guests/register/ - [F,L]' to .htaccess
# For nginx: add 'location ~ ^/apps/guests/register/ { return 403; }' to config
🧯 If You Can't Patch
- Implement rate limiting on the /apps/guests/register/ endpoint to slow enumeration
- Monitor logs for unusual patterns of requests to the vulnerable endpoint
🔍 How to Verify
Check if Vulnerable:
Test by accessing https://[your-owncloud]/apps/guests/register/test@example.com/12345 and observing if different responses occur for valid vs invalid emailsCheck Version:
occ app:list | grep guestsVerify Fix Applied:
After updating to 0.12.5+, test the same endpoint - all invalid requests should return consistent error responses📡 Detection & Monitoring
Log Indicators:
- Multiple 200/302 responses to /apps/guests/register/ with different email parameters
- Unusual patterns of failed authentication attempts following guest enumeration
Network Indicators:
- High volume of requests to /apps/guests/register/ endpoint from single IPs
- Sequential email address patterns in URL parameters
SIEM Query:
source="owncloud_access.log" AND uri_path="/apps/guests/register/" | stats count by src_ip