The vulnerability arises because the Nextcloud DAV plugin resolves file paths from the absolute request URI without confirming that the path segment corresponds to the authenticated session user. This flaw allows authenticated attackers to lock or unlock files belonging to other users by targeting absolute WebDAV paths. Additionally, the application returns lock tokens to unauthorized callers, which can be used to remove token-based locks set by other users. This improper authentication issue is tracked as CWE-287 and affects Nextcloud Files Lock versions from 31.0.0 up to and including 33.0.0.

An attacker with valid authentication can interfere with other users' file operations by locking their files, preventing legitimate write operations such as PUT, MOVE, DELETE, or editor saves. The attacker can also obtain lock tokens for other users' files, enabling them to remove locks that rely on these tokens. This results in confidentiality, integrity, and availability impacts rated as low to medium severity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict authenticated user permissions where possible and monitor for unusual file lock activity. Avoid relying solely on lock tokens for access control.