{"record":{"id":"4b82db9b1317ce22","repo":"nextcloud/server","slug":"s-with-name-s-could-not-be-found","errorCode":null,"errorMessage":"%s with name '%s' could not be found","messagePattern":"(.+?) with name '(.+?)' could not be found","errorType":"exception","errorClass":"Sabre\\DAV\\Exception\\NotFound","httpStatus":404,"severity":"warning","filePath":"apps/dav/lib/Connector/Sabre/DavAclPlugin.php","lineNumber":59,"sourceCode":"\t\t\t$node = $this->server->tree->getNodeForPath($uri);\n\n\t\t\tswitch (get_class($node)) {\n\t\t\t\tcase AddressBook::class:\n\t\t\t\t\t$type = 'Addressbook';\n\t\t\t\t\tbreak;\n\t\t\t\tcase Calendar::class:\n\t\t\t\tcase CachedSubscription::class:\n\t\t\t\t\t$type = 'Calendar';\n\t\t\t\t\tbreak;\n\t\t\t\tdefault:\n\t\t\t\t\t$type = 'Node';\n\t\t\t\t\tbreak;\n\t\t\t}\n\n\t\t\tif ($this->getCurrentUserPrincipal() === $node->getOwner()) {\n\t\t\t\tthrow new Forbidden('Access denied');\n\t\t\t} else {\n\t\t\t\tthrow new NotFound(\n\t\t\t\t\tsprintf(\n\t\t\t\t\t\t\"%s with name '%s' could not be found\",\n\t\t\t\t\t\t$type,\n\t\t\t\t\t\t$node->getName()\n\t\t\t\t\t)\n\t\t\t\t);\n\t\t\t}\n\n\t\t}\n\n\t\treturn $access;\n\t}\n\n\t#[\\Override]\n\tpublic function propFind(PropFind $propFind, INode $node) {\n\t\tif ($node instanceof Node) {\n\t\t\t// files don't use dav acls\n\t\t\treturn;","sourceCodeStart":41,"sourceCodeEnd":77,"githubUrl":"https://github.com/nextcloud/server/blob/ecdeb153ffdf227235c9a7e2d13dbe0f9c817bc3/apps/dav/lib/Connector/Sabre/DavAclPlugin.php#L41-L77","documentation":"The ACL check denied access to a node owned by someone else, so Nextcloud deliberately answers 404 ('Calendar/Addressbook/Node with name X could not be found') instead of 403 to avoid leaking the resource's existence. The type label is derived from the node class (Calendar, CachedSubscription, Addressbook, or generic Node).","triggerScenarios":"Accessing another user's calendar/addressbook by direct URL when no valid share exists: the share was revoked or expired, has not been accepted yet, or the principal segment of the URL is wrong.","commonSituations":"Stale calendar subscriptions after the owner unshared; clients caching old principal URLs across username changes; enumeration attempts probing for resource existence.","solutions":["Confirm the resource is actually shared with the authenticated principal and carries the needed permission.","Re-share or re-accept the share, then refresh or recreate the client subscription.","Verify the principal segment of the URL (correct, urlencoded owner uid)."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n    $client->propfind($calendarUrl, []);\n} catch (NotFound $e) { // 404: not shared with you, or truly gone\n    clearStaleSubscription($calendarUrl);\n    promptUserToReshare($calendarUrl);\n}","preventionTips":["Treat 404 on other users' calendars/addressbooks as a possibly-masked 403.","Refresh principal URLs after username changes.","Do not probe for resource existence by URL — the server intentionally hides it."],"tags":["dav","acl","calendar","addressbook","not-found"],"backgroundTag":"resource-not-found","analyzedSha":"ecdeb153ffdf227235c9a7e2d13dbe0f9c817bc3","analyzedAt":"2026-08-17T01:36:13.386Z","schemaVersion":2},"datasetVersion":"2026-08-17T04:17:16.089Z"}