CVE-2016-9461

CVE-2016-9461 describes a permission bypass vulnerability in Nextcloud Server before 9.0.52 and ownCloud Server before 9.0.4. An authenticated attacker could exploit this flaw by using a WebDAV COPY action to place new files into a read-only shared folder, bypassing intended access controls. The vulnerability is rated Medium severity (CVSS 4.3) due to its network attack vector and low complexity, though it only allows adding new files, not modifying existing ones, resulting in a low impact on integrity. There is no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.