Nextcloud · disclosed reports
Access Control
32 disclosed reports · $4,050 paid · 32 valid
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. A report opens its page here: our analysis where there is one, and the link to HackerOne. The status is HackerOne's own outcome; "access needed" is only what a title states.
Open Nextcloud on HackerOne- reports
- 32
- valid
- 32
- paid a bounty
- 11
Every one of the 32 is a mark on the map. Named now: 1 to 26, most upvoted first.
- User can delete data in shared folders he's not autorized to access
- Re-Sharing allows increase of privileges
- View-only guests could see deleted Collectives pages in the trashbin
- Valid share tokens allow to access tempory upload files of share owner
- Arbitrary Board Preference Injection via Deck Config API
- Default Nextcloud Server and Android Client leak sharee searches to Nextcloud
- Easy way to create a new Deck board without permission
- Download permissions can be changed by resharer
- Can download files on Android app without permission
- Delete external storage of any user
- End-to-end encrypted file-drops can be made inaccessible
- Can download files by zipping the folder
- Scoped apptokens can be changed by that very apptoken
- Deck app allowed user with "Can share" permission to modify permissions of other non-owners
- Read-only users can restore old versions
- Expired reshare links allow access to all files in share
- Bypass password confirmation via Context-dependent access control (CDCA)
- Group admins can remove arbitrary data from "data" directory (including admin data)
- files_lock: a write-share collaborator can place a TYPE_TOKEN lock that permanently denies the file owner, survives share revocation and account delet
- Sensitive files/ data exists post deletion of user account
- Talk Android broadcast receiver is not protected by broadcastPermission allowing malicious apps to communicate
- Disabled download shares still allow download through preview images
- Chat room member disclosure via autocomplete API
- User with read-only access to a share can gain write access to sub-folders in the share
- Access control issue -- [Allow file system access not validated when using session auth]
- Shared smart albums in the Photos app can expose files outside the album owner's configured source folders
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-15 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.