[Bug]: User-key server-side encryption fails on /remote.php/dav/files/ WebDAV endpoint in NC 35 (works on legacy /webdav/)

[Novae7]

⚠️ This issue respects the following points: ⚠️

• This is not a troubleshooting question, general support matter, or webserver/proxy problem, but likely a bug (if unsure, ask the Community Help Forum).
• This issue is not already reported on Github OR solved at the Community Help Forum (I've searched!).
• I'm using a maintained major version of Nextcloud Server and tested against the latest patch level. (Supported major versions and current patch levels).
• I agree to follow Nextcloud's Code of Conduct.
• I've tried my best to provide clear reproduction steps that someone unfamiliar with this bug could use to reproduce it.

Bug description

After upgrading from 34 to 35.0.0, files can no longer be read or written over WebDAV via /remote.php/dav/files/ when server-side encryption with per-user keys is active (master key disabled). The official desktop client and DAVx5 fail on every GET and PUT.

Errors in nextcloud.log:

• Sabre\DAV\Exception\ServiceUnavailable
• OCA\Encryption\Exceptions\PrivateKeyMissingException "Private Key missing for user: please try to log-out and log-in again"
• OCA\Encryption\Exceptions\DecryptionFailedException "Cannot decrypt this file, probably this is a shared file..."

What works and what doesn't (same user, same credentials, same encrypted files):

• /remote.php/dav/files/ (desktop client mirall, DAVx5): fails, GET and PUT.
• /remote.php/webdav/ (KeePass2Android via okhttp): works, verified writing a .kdbx.
• Web browser (cookie session): works.

The affected files are not shared (checked oc_share: they are in the owner's own home storage). Files open fine in the browser, so the stored data is intact.

Separate note: right after the upgrade, older files also would not open in the browser (showed 0 KB, "Unable to get header block" in the log). I had to set encryption.legacy_format_support=true to get browser reading working again. That fixed the browser side, but the /dav/files/ WebDAV failure described above stays regardless of that flag.

Before the upgrade (NC 34) all clients worked. There was a similar issue on NC 32.0.0 that went away with 32.0.2 (#55466 / #56167). Not sure if it's the same cause, just noting it looks similar.

Steps to reproduce

1. NC 35.0.0, server-side encryption enabled, per-user keys (master key disabled via occ encryption:disable-master-key).
2. Take an encrypted file in the user's own (unshared) home directory.
3. GET it over WebDAV via /remote.php/dav/files// with basic auth:
   curl -u user:apppassword https://host/remote.php/dav/files/user/file
   -> fails (503, "Cannot decrypt this file" / "Private Key missing for user").
4. GET the same file via /remote.php/webdav/ with the same credentials.
   -> works.
5. Open the same file in the web browser.
   -> works.

Expected behavior

GET/PUT over /remote.php/dav/files/ with valid credentials should return/store the decrypted file, same as the legacy /webdav/ endpoint and the browser already do.

Nextcloud Server version

35

Operating system

Debian/Ubuntu

PHP engine version

PHP 8.4

Web server

Nginx

Database engine version

MariaDB

Is this bug present after an update or on a fresh install?

Upgraded to a MAJOR version (ex. 31 to 32)

Are you using the Nextcloud Server Encryption module?

Encryption is Enabled

What user-backends are you using?

• Default user-backend (database)
• LDAP/ Active Directory
• SSO - SAML
• Other

Configuration report

{
    "system": {
        "instanceid": "***REMOVED SENSITIVE VALUE***",
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",
        "secret": "***REMOVED SENSITIVE VALUE***",
        "trusted_domains": [
            "arca.cubile.xyz"
        ],
        "datadirectory": "***REMOVED SENSITIVE VALUE***",
        "dbtype": "mysql",
        "version": "35.0.0.10",
        "overwrite.cli.url": "https:\/\/arca.cubile.xyz",
        "dbname": "***REMOVED SENSITIVE VALUE***",
        "dbhost": "***REMOVED SENSITIVE VALUE***",
        "dbtableprefix": "oc_",
        "mysql.utf8mb4": true,
        "dbuser": "***REMOVED SENSITIVE VALUE***",
        "dbpassword": "***REMOVED SENSITIVE VALUE***",
        "installed": true,
        "maintenance": false,
        "mail_smtpmode": "sendmail",
        "mail_sendmailmode": "smtp",
        "mail_from_address": "***REMOVED SENSITIVE VALUE***",
        "mail_domain": "***REMOVED SENSITIVE VALUE***",
        "memcache.local": "\\OC\\Memcache\\APCu",
        "memcache.distributed": "\\OC\\Memcache\\Redis",
        "memcache.locking": "\\OC\\Memcache\\Redis",
        "redis": {
            "host": "***REMOVED SENSITIVE VALUE***",
            "port": 0
        },
        "forbidden_filename_basenames": [
            "con",
            "prn",
            "aux",
            "nul",
            "com0",
            "com1",
            "com2",
            "com3",
            "com4",
            "com5",
            "com6",
            "com7",
            "com8",
            "com9",
            "com\u00b9",
            "com\u00b2",
            "com\u00b3",
            "lpt0",
            "lpt1",
            "lpt2",
            "lpt3",
            "lpt4",
            "lpt5",
            "lpt6",
            "lpt7",
            "lpt8",
            "lpt9",
            "lpt\u00b9",
            "lpt\u00b2",
            "lpt\u00b3"
        ],
        "forbidden_filename_characters": [
            "<",
            ">",
            ":",
            "\"",
            "|",
            "?",
            "*",
            "\\",
            "\/"
        ],
        "forbidden_filename_extensions": [
            " ",
            ".",
            ".filepart",
            ".part"
        ],
        "twofactor_enforced": "true",
        "twofactor_enforced_groups": [],
        "twofactor_enforced_excluded_groups": [],
        "maintenance_window_start": 1,
        "default_phone_region": "DE",
        "loglevel": 2,
        "theme": "",
        "encryption.legacy_format_support": true
    }
}

List of activated Apps

Enabled:
  - activity: 8.0.0
  - appstore: 2.0.0-dev.0
  - bruteforcesettings: 8.0.0
  - calendar: 6.6.1
  - circles: 35.0.0
  - cloud_federation_api: 2.0.0-dev.0
  - comments: 2.0.0-dev.0
  - contacts: 8.9.0
  - contactsinteraction: 2.0.0-dev.0
  - dashboard: 8.0.0-dev.0
  - dav: 2.0.0-dev.1
  - encryption: 3.0.0-dev.0
  - federatedfilesharing: 2.0.0-dev.1
  - files: 3.0.0-dev.0
  - files_downloadlimit: 5.3.0
  - files_lock: 35.0.0
  - files_pdfviewer: 8.0.0
  - files_reminders: 2.0.0-dev.0
  - files_sharing: 2.0.0-dev.1
  - files_trashbin: 2.0.0-dev.0
  - files_versions: 2.0.0-dev.0
  - logreader: 8.0.0
  - lookup_server_connector: 2.0.0-dev.0
  - nextcloud_announcements: 7.0.0
  - notifications: 8.0.0
  - oauth2: 2.0.0-dev.0
  - office: 1.1.0
  - password_policy: 7.0.0
  - photos: 8.0.0
  - privacy: 7.0.0
  - profile: 2.0.0-dev.0
  - provisioning_api: 2.0.0-dev.0
  - recommendations: 8.0.0
  - related_resources: 6.0.0
  - serverinfo: 7.0.0
  - settings: 2.0.0-dev.0
  - sharebymail: 2.0.0-dev.0
  - sharing: 1.0.4
  - support: 7.0.0
  - survey_client: 7.0.0
  - systemtags: 2.0.0-dev.0
  - text: 9.0.0
  - theming: 3.0.0-dev.0
  - twofactor_backupcodes: 2.0.0-dev.0
  - twofactor_nextcloud_notification: 9.0.0
  - twofactor_totp: 17.1.0
  - updatenotification: 2.0.0-dev.0
  - user_status: 2.0.0-dev.0
  - viewer: 8.0.0
  - weather_status: 2.0.0-dev.0
  - webhook_listeners: 2.0.0-dev.0
  - workflowengine: 3.0.0-dev.0
Disabled:
  - admin_audit: 2.0.0-dev.0
  - app_api: 35.0.0 (installed 32.0.0)
  - federation: 2.0.0-dev.0 (installed 1.22.0)
  - files_external: 2.0.0-dev.0
  - firstrunwizard: 8.0.0 (installed 5.0.0)
  - suspicious_login: 13.0.0
  - testing: 1.23.0
  - user_ldap: 2.0.0-dev.0

Nextcloud Signing status

No errors have been found.

Nextcloud Logs

{"reqId":"tyUPOI0hKsEy6iLsJSuZ","level":3,"time":"2026-09-20T20:18:49+00:00","remoteAddr":"84.173.196.112","user":"Novae","app":"webdav","method":"PUT","url":"/remote.php/dav/files/Novae/Bilder/Hochzeit%20Jenny%20&%20Uwe%2018.09.2026/PXL_20260918_065529734.TS-000.jpg","scriptName":"/remote.php","message":"Verschlüsselung nicht bereit: Private Key missing for user: please try to log-out and log-in again","userAgent":"Mozilla/5.0 (Windows) mirall/34.0.4 (build 20260916) (Nextcloud, windows-10.0.26200 ClientArchitecture: x86_64 OsArchitecture: x86_64)","version":"35.0.0.10","clientReqId":"f19c61aa-f1e1-444f-84c2-180d67bdfc12","exception":{"Exception":"Sabre\\DAV\\Exception\\ServiceUnavailable","Message":"Verschlüsselung nicht bereit: Private Key missing for user: please try to log-out and log-in again","Code":0,"Trace":[{"file":"/var/www/cloud/apps/dav/lib/Connector/Sabre/File.php","line":296,"function":"convertToSabreException","class":"OCA\\DAV\\Connector\\Sabre\\File","type":"->"},{"file":"/var/www/cloud/apps/dav/lib/Connector/Sabre/Directory.php","line":129,"function":"put","class":"OCA\\DAV\\Connector\\Sabre\\File","type":"->"},{"file":"/var/www/cloud/3rdparty/sabre/dav/lib/DAV/Server.php","line":1098,"function":"createFile","class":"OCA\\DAV\\Connector\\Sabre\\Directory","type":"->","args":["*** sensitive parameters replaced ***"]},{"file":"/var/www/cloud/3rdparty/sabre/dav/lib/DAV/CorePlugin.php","line":504,"function":"createFile","class":"Sabre\\DAV\\Server","type":"->","args":["*** sensitive parameters replaced ***"]},{"file":"/var/www/cloud/3rdparty/sabre/event/lib/WildcardEmitterTrait.php","line":89,"function":"httpPut","class":"Sabre\\DAV\\CorePlugin","type":"->"},{"file":"/var/www/cloud/3rdparty/sabre/dav/lib/DAV/Server.php","line":472,"function":"emit","class":"Sabre\\DAV\\Server","type":"->"},{"file":"/var/www/cloud/apps/dav/lib/Connector/Sabre/Server.php","line":216,"function":"invokeMethod","class":"Sabre\\DAV\\Server","type":"->"},{"file":"/var/www/cloud/apps/dav/lib/Server.php","line":436,"function":"start","class":"OCA\\DAV\\Connector\\Sabre\\Server","type":"->"},{"file":"/var/www/cloud/apps/dav/appinfo/v2/remote.php","line":25,"function":"exec","class":"OCA\\DAV\\Server","type":"->"},{"file":"/var/www/cloud/remote.php","line":158,"args":["/var/www/cloud/apps/dav/appinfo/v2/remote.php"],"function":"require"},{"file":"/var/www/cloud/lib/OC.php","line":1397,"function":"{closure:/var/www/cloud/remote.php:102}","args":["*** sensitive parameters replaced ***"]},{"file":"/var/www/cloud/remote.php","line":102,"function":"handleRequests","class":"OC","type":"::"}],"File":"/var/www/cloud/apps/dav/lib/Connector/Sabre/File.php","Line":639,"Previous":{"Exception":"OCA\\Encryption\\Exceptions\\PrivateKeyMissingException","Message":"Private Key missing for user: please try to log-out and log-in again","Code":0,"Trace":[{"file":"/var/www/cloud/apps/encryption/lib/KeyManager.php","line":384,"function":"getPrivateKey","class":"OCA\\Encryption\\Session","type":"->"},{"file":"/var/www/cloud/apps/encryption/lib/Crypto/Encryption.php","line":136,"function":"getFileKey","class":"OCA\\Encryption\\KeyManager","type":"->"},{"file":"/var/www/cloud/lib/private/Files/Stream/Encryption.php","line":231,"function":"begin","class":"OCA\\Encryption\\Crypto\\Encryption","type":"->"},{"function":"stream_open","class":"OC\\Files\\Stream\\Encryption","type":"->"},{"file":"/var/www/cloud/lib/private/Files/Stream/Encryption.php","line":157,"function":"fopen"},{"file":"/var/www/cloud/lib/private/Files/Stream/Encryption.php","line":131,"function":"wrapSource","class":"OC\\Files\\Stream\\Encryption","type":"::"},{"file":"/var/www/cloud/lib/private/Files/Storage/Wrapper/Encryption.php","line":375,"function":"wrap","class":"OC\\Files\\Stream\\Encryption","type":"::"},{"file":"/var/www/cloud/lib/private/Files/Storage/Wrapper/Encryption.php","line":935,"function":"fopen","class":"OC\\Files\\Storage\\Wrapper\\Encryption","type":"->"},{"file":"/var/www/cloud/lib/private/Files/Storage/Wrapper/Wrapper.php","line":393,"function":"writeStream","class":"OC\\Files\\Storage\\Wrapper\\Encryption","type":"->"},{"file":"/var/www/cloud/apps/dav/lib/Connector/Sabre/File.php","line":232,"function":"writeStream","class":"OC\\Files\\Storage\\Wrapper\\Wrapper","type":"->"},{"file":"/var/www/cloud/apps/dav/lib/Connector/Sabre/Directory.php","line":129,"function":"put","class":"OCA\\DAV\\Connector\\Sabre\\File","type":"->"},{"file":"/var/www/cloud/3rdparty/sabre/dav/lib/DAV/Server.php","line":1098,"function":"createFile","class":"OCA\\DAV\\Connector\\Sabre\\Directory","type":"->","args":["*** sensitive parameters replaced ***"]},{"file":"/var/www/cloud/3rdparty/sabre/dav/lib/DAV/CorePlugin.php","line":504,"function":"createFile","class":"Sabre\\DAV\\Server","type":"->","args":["*** sensitive parameters replaced ***"]},{"file":"/var/www/cloud/3rdparty/sabre/event/lib/WildcardEmitterTrait.php","line":89,"function":"httpPut","class":"Sabre\\DAV\\CorePlugin","type":"->"},{"file":"/var/www/cloud/3rdparty/sabre/dav/lib/DAV/Server.php","line":472,"function":"emit","class":"Sabre\\DAV\\Server","type":"->"},{"file":"/var/www/cloud/apps/dav/lib/Connector/Sabre/Server.php","line":216,"function":"invokeMethod","class":"Sabre\\DAV\\Server","type":"->"},{"file":"/var/www/cloud/apps/dav/lib/Server.php","line":436,"function":"start","class":"OCA\\DAV\\Connector\\Sabre\\Server","type":"->"},{"file":"/var/www/cloud/apps/dav/appinfo/v2/remote.php","line":25,"function":"exec","class":"OCA\\DAV\\Server","type":"->"},{"file":"/var/www/cloud/remote.php","line":158,"args":["/var/www/cloud/apps/dav/appinfo/v2/remote.php"],"function":"require"},{"file":"/var/www/cloud/lib/OC.php","line":1397,"function":"{closure:/var/www/cloud/remote.php:102}","args":["*** sensitive parameters replaced ***"]},{"file":"/var/www/cloud/remote.php","line":102,"function":"handleRequests","class":"OC","type":"::"}],"File":"/var/www/cloud/apps/encryption/lib/Session.php","Line":66,"Hint":"Private Key missing for user: please try to log-out and log-in again"},"message":"Verschlüsselung nicht bereit: Private Key missing for user: please try to log-out and log-in again","exception":"{\"class\":\"Sabre\\DAV\\Exception\\ServiceUnavailable\",\"message\":\"Verschlüsselung nicht bereit: Private Key missing for user: please try to log-out and log-in again\",\"code\":0,\"file\":\"/var/www/cloud/apps/dav/lib/Connector/Sabre/File.php:639\",\"trace\":\"#0 /var/www/cloud/apps/dav/lib/Connector/Sabre/File.php(296): OCA\\DAV\\Connector\\Sabre\\File->convertToSabreException()\\n#1 /var/www/cloud/apps/dav/lib/Connector/Sabre/Directory.php(129): OCA\\DAV\\Connector\\Sabre\\File->put()\\n#2 /var/www/cloud/3rdparty/sabre/dav/lib/DAV/Server.php(1098): OCA\\DAV\\Connector\\Sabre\\Directory->createFile()\\n#3 /var/www/cloud/3rdparty/sabre/dav/lib/DAV/CorePlugin.php(504): Sabre\\DAV\\Server->createFile()\\n#4 /var/www/cloud/3rdparty/sabre/event/lib/WildcardEmitterTrait.php(89): Sabre\\DAV\\CorePlugin->httpPut()\\n#5 /var/www/cloud/3rdparty/sabre/dav/lib/DAV/Server.php(472): Sabre\\DAV\\Server->emit()\\n#6 /var/www/cloud/apps/dav/lib/Connector/Sabre/Server.php(216): Sabre\\DAV\\Server->invokeMethod()\\n#7 /var/www/cloud/apps/dav/lib/Server.php(436): OCA\\DAV\\Connector\\Sabre\\Server->start()\\n#8 /var/www/cloud/apps/dav/appinfo/v2/remote.php(25): OCA\\DAV\\Server->exec()\\n#9 /var/www/cloud/remote.php(158): require('...')\\n#10 /var/www/cloud/lib/OC.php(1397): {closure:/var/www/cloud/remote.php:102}()\\n#11 /var/www/cloud/remote.php(102): OC::handleRequests()\\n#12 {main}\",\"previous\":{\"class\":\"OCA\\Encryption\\Exceptions\\PrivateKeyMissingException\",\"message\":\"Private Key missing for user: please try to log-out and log-in again\",\"code\":0,\"file\":\"/var/www/cloud/apps/encryption/lib/Session.php:66\",\"trace\":\"#0 /var/www/cloud/apps/encryption/lib/KeyManager.php(384): OCA\\Encryption\\Session->getPrivateKey()\\n#1 /var/www/cloud/apps/encryption/lib/Crypto/Encryption.php(136): OCA\\Encryption\\KeyManager->getFileKey()\\n#2 /var/www/cloud/lib/private/Files/Stream/Encryption.php(231): OCA\\Encryption\\Crypto\\Encryption->begin()\\n#3 [internal function]: OC\\Files\\Stream\\Encryption->stream_open()\\n#4 /var/www/cloud/lib/private/Files/Stream/Encryption.php(157): fopen()\\n#5 /var/www/cloud/lib/private/Files/Stream/Encryption.php(131): OC\\Files\\Stream\\Encryption::wrapSource()\\n#6 /var/www/cloud/lib/private/Files/Storage/Wrapper/Encryption.php(375): OC\\Files\\Stream\\Encryption::wrap()\\n#7 /var/www/cloud/lib/private/Files/Storage/Wrapper/Encryption.php(935): OC\\Files\\Storage\\Wrapper\\Encryption->fopen()\\n#8 /var/www/cloud/lib/private/Files/Storage/Wrapper/Wrapper.php(393): OC\\Files\\Storage\\Wrapper\\Encryption->writeStream()\\n#9 /var/www/cloud/apps/dav/lib/Connector/Sabre/File.php(232): OC\\Files\\Storage\\Wrapper\\Wrapper->writeStream()\\n#10 /var/www/cloud/apps/dav/lib/Connector/Sabre/Directory.php(129): OCA\\DAV\\Connector\\Sabre\\File->put()\\n#11 /var/www/cloud/3rdparty/sabre/dav/lib/DAV/Server.php(1098): OCA\\DAV\\Connector\\Sabre\\Directory->createFile()\\n#12 /var/www/cloud/3rdparty/sabre/dav/lib/DAV/CorePlugin.php(504): Sabre\\DAV\\Server->createFile()\\n#13 /var/www/cloud/3rdparty/sabre/event/lib/WildcardEmitterTrait.php(89): Sabre\\DAV\\CorePlugin->httpPut()\\n#14 /var/www/cloud/3rdparty/sabre/dav/lib/DAV/Server.php(472): Sabre\\DAV\\Server->emit()\\n#15 /var/www/cloud/apps/dav/lib/Connector/Sabre/Server.php(216): Sabre\\DAV\\Server->invokeMethod()\\n#16 /var/www/cloud/apps/dav/lib/Server.php(436): OCA\\DAV\\Connector\\Sabre\\Server->start()\\n#17 /var/www/cloud/apps/dav/appinfo/v2/remote.php(25): OCA\\DAV\\Server->exec()\\n#18 /var/www/cloud/remote.php(158): require('...')\\n#19 /var/www/cloud/lib/OC.php(1397): {closure:/var/www/cloud/remote.php:102}()\\n#20 /var/www/cloud/remote.php(102): OC::handleRequests()\\n#21 {main}\"}}","CustomMessage":"Verschlüsselung nicht bereit: Private Key missing for user: please try to log-out and log-in again"},"id":"6ab04b921eebf"}

Additional info

• Encryption: per-user keys, master key disabled (occ encryption:disable-master-key). Confirmed via oc_appconfig encryption/useMasterKey=0 — this isn't shown in occ config:list system.
• encryption app version is 3.0.0-dev.0.
• The fix(encryption): Fix user key support with basic auth #56167 change for [Bug]: Regression in User-Based Server-Side Encryption Breaks WebDAV Clients #55466 does seem to be in the 35.0.0 code (KeyManager.php uses userSession->getUser()?->getUID()), but the problem is back on 35. I haven't checked further whether it's the same root cause.
• Nextcloud Office (office 1.1.0) is enabled. I know it's not supported with SSE and can throw its own "cannot decrypt" errors, but this report is about plain .jpg/.txt files via mirall/DAVx5 over /dav/files/, not Office documents.
• Web server Nginx, PHP 8.4, MariaDB 11.8, Redis.